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I.  INTSODOCTIOS 


Early  warning  information  provides  decision  makers  with 
a  description  of  enemy  forces  as  they  prepare  for,  or  actu¬ 
ally  initiate,  an  attack.  Given  early  warning,  decision 
makers  in  the  military  and  the  government,  including  the 
President,  can  more  adequately  decide  on  a  response  during  a 
crisis.  When  policy  makers  discuss  changes  to  the  regula¬ 
tions  pertaining  to  the  early  warning  system,  they  need  to 
realize  the  implications  of  such  policy  changes  on  the 
system.  This  thesis  presents  the  current  early  warning 
system,  discusses  proposed  launch  policies,  and  explores  the 
possible  results  from  implementing  these  policies. 

Warning  information  is  essential  for  the  survival  of  the 
many  parts  of  our  arsenal  and  its  related  control  systems. 
For  example,  the  bomber  force  depends  on  timely  early 
warning  so  that  it  may  scramble  from  ground  alert  to 
airborne  stations  where  it  is  less  vulnerable  to  nuclear 
attack.  But  the  use  of  warning  to  save  the  bomber  force,  or 
any  other  weapon  system,  addresses  only  a  narrow  aspect  of 
warning.  The  most  important  aspect  of  early  warning  is  to 
give  advance  warning  of  an  enemy’s  attack,  so  that  the  deci¬ 
sion  maker  has  a  chance  to  give  the  appropriate  response  to 
an  attack.  Both  the  United  States  and  the  Soviet  Onion 
continue  to  build  systems  of  extreme  complexity  for  early 
warning.  Intelligence  systems  have  merged  with  warning 
systems,  yielding  one  overall  system  which  is  integrated 
vertically  with  military  forces. 

Future  strategic  technology  is  likely  to  make  nuclear 
war  more  thinkable,  especially  as  nuclear  weapons  spread  to 
unstable  countries  less  inclined  to  respect  the  nuclear 
threshold.  The  problem  of  nuclear  weapons  proliferation 
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concerns  a  large  number  of  governments  and  is  intimately 
related  to  the  basic  energy  needs  of  both  the  developed  and 
developing  nations.  It  has  fast  become  an  issue  of  high 
politics  on  a  global  scale.  Further,  many  of  the  developing 
nations  claim  that  the  CJnited  States,  in  the  name  of  non¬ 
proliferation,  seeks  to  implement  policies  that  are  highly 
discriminatory  to  the  non-nuclear  states  and  are  designed  to 
maintain  American  political,  military,  and  economic  power  at 
the  expense  of  the  poorer  nations.  Hence,  no  global 
consensus  exists  on  either  the  threat  posed  by  nuclear 
proliferation  or  the  steps  that  should  be  taken  to  deal  with 
it.  Instead,  this  issue  inflames  domestic  debate  in  many 
nations,  strains  alliance  relationships,  sharpens  the 
confrontation  between  East  and  West,  and  complicates 
concepts  of  national  and  international  security.  within 
this  framework  of  the  threat  of  general  nuclear  war  exists  a 
concern  for  accidental  or  unintentional  nuclear  war. 

We  are  rapidly  approaching  a  decisive  point  of  demarca¬ 
tion  in  the  history  of  the  nuclear  arms  race;  namely,  the 
first  strike  counter-force  threshold.  This  means  both  the 
arsenals  of  the  United  States  and  the  USSR  will  be  highly 
vulnerable  to  surprise  attack.  As  a  result,  efforts  to 
control  the  momentum  and  direction  of  the  nuclear  arms  race 
are  increasingly  complicated  and  the  possibility  for  acci¬ 
dental  war  substantially  grows. 

Senator  Mark  Hatfield  describes  the  threat  as  our 
perception  of  a  Soviet  weapons  build-up,  a  nuclear  blackmail 
[Hef.  1:  p.  3].  He  describes  the  Soviet  Intercontinental 
Ballistic  Missile  (ICBM)  threat  as  impressive,  yet  destabi¬ 
lizing,  because  we  can  no  longer  rely  on  technology  to  save 
us  from  war.  Following  a  decade  of  massive  arms  spending, 
the  Soviet  Union  comes  to  the  current  round  of  disarmament 
talks  with  a  suffering  economy.  Still,  Hatfield  claims,  the 
United  States  strategists  point  to  the  Soviet’s  apparent 
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superiority  by  counting  the  number  of  Soviet  warheads  and 
comparing  this  to  the  number  of  our  warheads.  In  this 
paper,  our  real  concern  is  not  with  the  numbers  question, 
but  with  how  accurately  and  quickly  we  can  discern  if  we  are 
under  attack  and  what  should  be  the  appropriate  response. 
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e.  Two  Radars  in  the  Southern  United  States 
--long  range  phased  array  radars 

— uses  pattern  recognition  of  current  space  objects 

--back-up  system  performs  a  full  search  with  human 
intervention 

--operates  on  UHF  frequencies 

--supplements  SLBM  detection  from  the  Gulf  of  Mexico 

--receives  inputs  from  BMEWS  and  the  Onited  States  Navy 
Space  Surveillance  (SPASOR)  network 

f.  Cobra  Dane 

--a  large,  real-time  tracking  phased  array  radar  in  the 
Aleutian  IsLands  of  Alaska 

--detects  and  tracks  ICBMs,  SIBMS,  and  satellites 

— predicts  impact  points 

--primarily  collects  intelligence  data 

2 .  Ground  Processing  and  Communication  System 

--ground  stations  in  the  continental  United  States  and 
overseas  which  process  the  data  from  the  sensors 

— communication  processing  stations  co-located  with  the 
sensors 

A  thorough  discussion  of  the  communication  function  follows 
later  in  this  chapter. 

3 .  Command  Posts 

a.  North  American  Aerospace  Defense  Command  (NORAD) 
— described  later  in  Section  D  of  this  chapter 
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-provides  precise  data  on  the  character  and  magnitude  of 
a  missile  attack 

(2)  Static  Radar  in  Greenland  and.  Alaska . 

-evaluates  missile  position  and  velocity 

-calculates  the  trajectory,  impact  point,  impact  time, 
and  launch  point 

c.  Pave  Paws 

-a  large  multi- targeting  phased  array  radar  in  California 
and  Massach  usetts 

-operated  and  maintained  by  the  Strategic  Air  Command 
-primarily  detects  SLBMs 

-relays  the  characterization  of  the  attack  to  NORAD,  SAC, 
and  the  National  Command  Authorities  (NCA) 

-simultaneously  detects  and  discriminates  many  objects 
while  providing  early  warning  data,  launch,  impact, 
position,  and  velocity  information 

-provides  automatic  detection,  track  initiation,  and 
mission  decisions 

-operates  at  UHF  freguencies 

d.  Perimeter  Acquisition  Radar  Attack  Character¬ 
ization  System  (PARCS) 

-located  in  North  Dakota 

-tracks  incoming  ICBMs 

-directs  the  launching  of  missiles 

-very  accurate 
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III.  DATA  GATHERING  MODEL 


A.  THE  COBRENT  MISSILE  ATTACK  WARNING  SYSTEM 

The  Missile  Attack  Warning  System  consists  of  three 
parts:  (1)  sensors  to  detect  a  missile  launch,  (2)  computer 
centers  and  communication  links  to  process  and  distribute 
the  data  from  the  warning  system,  and  (3)  command  posts 
which  analyze  data  and  assess  the  implications  of  the 
warning  information  and  direct  appropriate  actions.  Major 
components  of  each  of  the  above  parts  follow: 

1 •  Missile  Warning  Sensors 

a.  Satellite  Early  Warning  System  (SEWS) 

— detects  infrared  trail  of  a  burning  missile  motor 

— provides  overlapping  coverage  for  the  Soviet  Onion  and 
China  (for  ICBMs) 

—  provides  overlapping  coverage  for  the  Atlantic  and 
Pacific  Oceans  (for  SLBMs) 

— transmits  real-time  information  due  to  the  nature  of  the 
SLBM  detection  problem 

— ground  stations  process  and  forward  data  to  the  command 
posts 

b.  Ballistic  Missile  Early  Warning  System  (3MEWS) 

(1)  Large  Tracking  Radar  in  Greenland.  England, 
and  Alaska. 

—  detects  and  continuously  searches  for  an  object 

--operates  on  several  OH?  frequencies 
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over-simplified  or  overlooked  many  assumptions.  Although 
these  discussions  thoroughly  delineated  the  problem,  little 
has  been  written  to  answer  the  questions  they  raise.  We 
investigate  and  discuss  these  questions  in  Chapters  III  and 
IV. 


B.  HETHODOLOGY  OP  THIS  STUDY 

In  the  next  two  chapters,  we  discuss  two  parts  of  the 
missile  warning  function — data  gathering  and  decision 
making.  These  two  separate,  yet  interrelated,  parts  demon¬ 
strate  the  role  the  man-in-the-loop  plays  and  the  importance 
of  maintaining  this  role  as  we  consider  the  implications  of 
certain  launch  policies. 

The  Data  fathering  Model  completely  covers  all  of  the 
mechanical  aspects — sensors,  ground  stations,  command 
posts — as  well  as  describing  decision  rules,  such  as  dual 
phenomenology.  The  Data  Gathering  Model  also  presents 
several  scenarios  of  interest  with  an  accompanying  sensi¬ 
tivity  analysis  to  show  how  time  affects  the  decision-making 
process. 

The  Decision  Model  adds  decision  points  to  the  Data 
Gathering  Model  and  incorporates  in  greater  detail  the  same 
scenarios  from  the  Data  Gathering  Model.  The  sensitivity 
analysis  further  directs  attention  toward  the  need  for  a 
policy  to  balance  the  current  situation.  In  Chapter  V,  we 
discuss  two  types  of  launch  policies  and  their  implications. 
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more  automatic.  On  that  basis,  the  decision  to  launch  is 
then  automatically  carried  out  by  the  computer  system.  This 
view  misses  the  intimate  relationship  between  warning  and 
alert  levels  on  the  one  hand,  and  control  of  offensive 
weapons  on  the  other.  It  also  fails  to  consider  the  checks 
and  balances  {that  is,  the  man-in-the-loop)  set  up 
throughout  the  entire  missile  warning  system. 

Many  differing  opinions  concerning  different  policy 
types  and  policy  definitions  exist  among  the  authors  cited. 
Sennott  et  al  define  launch-on -warning  to  mean  if  a  situ¬ 
ation  can  not  be  called  a  non-threat,  then  it  is  a  threat; 
therefore,  launch  [Hef.  8:  p.  2].  However,  this  definition 
does  not  completely  cover  the  current  decision  process 
employed  by  NORA D.  Steinbruner' s  definition  is  very  vague; 
he  defines  launch-under-attack  (equal  to  launch-on-warning) 
as  launching  missiles  after  acquiring  reliable  evidence  that 
a  Soviet  attack  is  underway  before  its  actual  effects  are 
felt  [Bef.  9:  p.  37].  Bracken  uses  the  term  automatic 
retaliation,  but  defines  launch-on- warning  to  include  the 
military  decision  makers,  who  are  given  emergency  authority 
to  use  nuclear  weapons  in  advance  of  hostilities,  and  who 
are  further  instructed  to  use  this  authority  if  indications 
of  an  attack  arise.  Then,  Bracken  states  that  a  launch-on- 
warning  strategy  does  not  require  any  computers  or  radar, 
although  they  are  necessary  to  implement  such  a  strategy 
smoothly. 

Although  many  different  launch  policies  appear  in 
different  articles,  only  two  stand  out  as  viable  alter¬ 
natives — launch- under-attack  and  launch-on-warning.  As 
described  above,  definitions  of  these  policies  vary  widely, 
depending  on  the  source.  We  offer  clearer  definitions  in 
Chapter  V  and  further  pursue  their  implications. 

In  all  the  cited  articles,  the  authors  hardly 
considered  NORAD,  left  out  the  actual  decision  process,  and 
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with  NO  R  AD ' s  definition  of  a  false  alarm  (which  is  incorpo¬ 
rated  into  our  definition),  and  this  difference  may  affect 
the  conclusions  of  their  research. 

Steinbruner  discusses  the  background  of  the  launch- 
under-attack  policy,  an  ICBM  scenario,  and  then  centers  on 
the  command,  control,  and  communications  (C3)  problem 
[Ref.  9].  He  also  includes  the  Brookings  model  written  by 
Horawski  and  Blair.  This  model  simulates  the  performance  of 
the  C3  system  under  four  kinds  of  damage  conditions  and 
investigates  the  ability  of  the  system  to  retaliate.  The 
article  concludes  by  stating  that  even  our  considering  a 
launch-under-attack  policy  demonstrates  the  increasing 
tensions  between  ourselves  and  the  Soviets. 

The  authors  mentioned  above  (as  well  as  others 
referenced)  hold  the  common  view  that  the  world  is  on  the 
brink  of  accidental  nuclear  war.  With  increased  interna¬ 
tional  tension,  coupled  with  the  increasing  number  of 
missile  displays,  this  conclusion  might  appear  true  on  the 
surface.  Even  using  the  definition  of  a  false  alarm  as 
delineated  by  Sennott  et  al,  the  apparent  increase  in  these 
alarms  may  be  explained  by  the  following  facts:  (1)  more 

sensitive  sensors  are  on  line  and  operators  must  continue  to 
calibrate,  test,  and  evaluate  them;  (2)  the  Soviets  have 
increased  their  testing  of  missiles;  and  (3)  the  Joint 
Chiefs  of  Staff  have  revised  the  criteria  for  convening 
missile  display  conferences.  Even  if  intelligence  provides 
information  regarding  a  test  shot,  NORAD  continues  to 
monitor,  evaluate,  and  test  its  system  on  these  live 
launches.  Thus,  the  detection  of  any  launch  is  added  to  the 
permanent  record. 

Several  of  the  authors  assumed  that  the  man-in-the- 
loop  would  lose  control  of  the  decision-making  process  by 
being  left  out  at  certain  points  in  the  process,  or  that  the 
data  gathering  system  makes  the  man-in-the-loop’ s  decision 
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This  gigantic  system  contains  four  components — the  United 
States  warning  system,  the  United  States  launch  system,  the 
Soviet  warning  system,  and  the  Soviet  launch  system. 

Bereanu  argues  that  if  the  United  States  warning  system 
responds  to  an  alarm,  it  will  automatically  trigger  the 
United  States  launch  system  which  automatically  triggers 
the  Soviet  warning  system  which  automatically  triggers  the 
Soviet  launch  system  all  of  which  leads  to  a  nuclear  war. 
And,  if  this  was  a  false  alarm,  it  would  lead  to  an  acci¬ 
dental  nuclear  war. 

Bereanu* s  model  also  assumes  that  more  and  more  of 
the  human  decision  making  will  be  turned  over  to  a  computer 
system.  Thus,  Bereanu  implies  that  if  the  computer  system 
errs  and  reports  a  missile  launch  when,  in  fact,  no  launch 
has  occurred,  the  decision  maker  will  automatically  respond 
in  kind;  that  is,  launch  a  missile  in  retaliation.  However, 
is  the  total  system  interlocked  and  automatic?  This  ques¬ 
tion  will  be  addressed  in  the  following  chapters. 

Sennott  and  Crissey  developed  a  computer  simulation 
model  and  a  queuing  theory  model  to  show  how  increasing 
false  alarms  lead  to  an  increase  in  the  probability  of  acci¬ 
dental  nuclear  war  [Bef.  8],  The  basis  of  their  study 
revolves  around  the  apparent  increasing  number  of  false 
alarms,  but  using  a  different  definition  of  false  alarm  than 
we  use  in  this  paper.  Sennott  and  Crissey  define  "false 
alarms"  as  conferences  called  to  evaluate  possible  threats 
(which  are  otherwise  known  as  missile  display  conferences) 
and  use  the  data  to  predict  the  frequency  of  such  threats  in 
their  models.  They  then  claim  that  accidental  nuclear  war 
will  occur  if  a  false  alarm  takes  too  long  to  resolve.  That 
is,  if  the  time  required  to  resolve  the  alarm  exceeds  the 
use  them  or  lose  them  point,  then  retaliation  is  automatic. 
They  also  equated  false  alerts  with  threat  assessment 
conferences.  However,  these  definitions  do  not  coincide 
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alarms,  since  a  false  alarm  that  is  not  resolved  could  lead 
to  accidental  nuclear  war. 

Bereaau  built  an  analytical  model  on  the  self¬ 
activation  of  a  nuclear  weapons  system  [fiefs.  5,7].  His 
model  assumes  that  both  the  United  States  and  Soviet  warning 
and  launch  systems  are  interconnected: 


Figure  2.2  The  Bereanu  Model 
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Figure  2. 1  Type  I/Type  II  Error  flatrix 

The  two  error  types  occur  where  the  asterisks  (*) 
are  located.  On  the  one  hand,  we  want  to  lower  the 
probability  of  not  launching  a  retaliatory  strike  when  we 
are  under  attack  (the  military  does  not  want  to  make  this 
mistake).  On  the  other  hand,  we  also  want  to  lower  the 
probability  of  launching  a  retaliatory  strike  when  we  are 
not  under  attack  (i.  e. ,  causing  an  unintentional  nuclear 
war)  .  Note  the  trade-off  involved  with  the  two  error  types: 
we  can  not  lower  the  probability  of  one  error  type  without 
raising  the  probability  of  the  other,  due  to  the  very  nature 
of  Type  I/Type  II  errors.  But  we  can  continue  to  search  for 
a  policy  which  gives  the  best  balance  between  Type  I  and 
Type  II  errors. 

4.  Previous  Investigations  of  the  Problem 

The  incidents  of  false  alarms  at  NORAD  generated 
several  studies  and  sparked  a  renewed  interest  in  launch 
policies.  These  studies  focused  on  a  need  to  watch  false 
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taken  in  the  entire  missile  warning  system  has  helped  to 
resolve  incoming  missile  displays  sooner,  severely 
curtailing  false  alarms.  No  false  alarms  have  occurred 
since  1980. 

Another  contribution  to  the  cause  of  accidental 
nuclear  war  is  the  greater  international  tension  brought 
about  by  our  increased  nuclear  stance  and  the  inclusion  of 
the  Star  Wars  weapons  system  in  our  arsenal.  This  means 
that  the  United  States  is  willing  to  take  a  risk  to  protect 
itself  from  the  threat  of  an  attack  by  establishing  a 
launch-under-attack  policy.  Most  Americans  believe  that 
their  nation  is  not  morally  capable  of  initiating  a  nuclear 
war  under  any  situation.  Yet,  the  initiation  of  a  policy, 
like  launch-under-attack  or  la unch-on- warning,  sends  a 
signal  to  our  potential  enemies.  It  is  important  in  the 
interest  of  peace  that  the  Soviets  clearly  perceive  our  true 
intentions. 

3.  The  Problem  of  Accidental  Nuclear  War 

The  main  goal  of  the  United  States  military  is  to 
enhance  the  capabilities  of  our  weapons  if  we  must  use  them, 
and  to  increase  weapon  survivability  if  we  are  pre-emptively 
attacked.  But  we  also  desire  the  possibility  of  launching 
our  weapons  to  be  zero  when  we  are  not  under  attack,  we  can 
describe  this  conflict  using  a  Type  I/Type  II  error  model. 

A  Type  I  error  occurs  when  an  attack  is  coming,  but  the 
warning  process  fails  and  indicates  that  we  are  not  under 
attack;  thus,  no  counter-strike  is  launched.  A  Type  II 
error  occurs  when  no  attack  is  forthcoming,  but  the  warning 
process  fails  and  indicates  that  we  are  under  attack;  thus, 
a  counter-strike  is  launched  when  no  threat  exists,  leading 
to  an  accidental  nuclear  war.  The  matrix  in  Figure  2.1 
below  delineates  the  possibilities: 
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not  the  S IBM  forces. )  He  claims  that  the  deployment  of 
missiles  in  Europe  would  limit  this  time  span  to  5-7 
minutes;  thus,  precluding  chances  to  avert  an  all-out 
confrontation.  However,  he  fails  to  mention  the  SLBM  threat 
which  has  about  the  same  time  span  to  avert  a  confrontation: 
5-9  minutes  versus  25-30  minutes  for  ICBMs.  Although  the 
Soviet  ICBN  threat  is  potentially  more  destructive  to  our 
retaliatory  forces,  the  SLBM  threat  severely  shortens 
decision-making  time  which  affects  the  launching  of  retalia¬ 
tory  forces. 

The  mechanisms  which  might  precipitate  an  uninten¬ 
tional  or  accidental  nuclear  war  entail  our  steady 
progression  of  technological  advances  in  eguipment,  such  as 
satellite  sensors,  and  increasingly  sophisticated  computer 
software.  These  enhanced  capabilities  allow  faster  evalua¬ 
tion  of  events  that  take  place  in  the  atmosphere  or  space, 
as  well  as  on  the  ground,  and  they  provide  a  clearer  picture 
of  the  global  military  situation.  Yet,  errors  in  the  data 
gathering  function  (which  includes  all  sensors,  communica¬ 
tion  links,  and  computer  systems)  already  have  caused  false 
alarms  at  NORAD,  our  main  surveillance  center.  In  this 
discussion,  a  false  alarm  is  a  display  from  the  data  gath¬ 
ering  system  which  indicates  the  launch  of  missiles  towards 
a  United  States  defended  area  with  impact  points  in  that 
area,  but  is,  in  fact,  not  real.  Routine  missile  displays 
do  occur  every  year,  but  NORAD  does  not  label  these  as  false 
alarms.  Rather,  NORAD  resolves  these  routine  missile 
displays  using  the  usual  surveillance  procedures  prior  to 
any  need  for  decisions  from  higher  authority. 

Four  false  alarms,  occurring  in  the  fall  of  1979  and 
the  spring  of  1980,  received  international  attention 
[Bef.  5:  p.  8].  However,  NORAD  located  and  corrected  the 
problems  surrounding  these  alarms  without  an  inadvertent 
launch  of  retaliatory  forces.  Since  then,  the  added  care 
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2.  The  Causes  of  the  Co ncern 

The  major  threatening  influence  on  the  evolution  of 
our  warning  system  is  the  stationing  of  Soviet  nuclear- 
firing  submarines  near  the  coastlines  of  the  United  States. 
Op  until  the  late  1960s,  Soviet  submarines  were  located 
under  the  Arctic  ice  cap.  A  launch  of  a  Submarine-Launched 
Ballistic  Missile  (hereafter,  SLBH)  from  that  position 
provided  some  time  for  decision  makers  to  discuss  and  recom¬ 
mend  appropriate  responses  to  that  threat.  Now,  Soviet 
Yankee  and  Delta  class  submarines  regularly  patrol  near  our 
coasts  [Kef.  3].  Depending  on  tactics  and  firing  position, 
these  submarines  could  fire  SLBMs  at  our  bomber  bases  and 
command  centers  with  flight  times  ranging  between  4  and  15 
minutes.  Then,  they  can  aim  at  Washington,  the  North 
American  Aerospace  Defense  Command  (NORAD) ,  and  the 
Strategic  Air  Command  (SAC)  in  an  effort  to  paralyze  the 
retaliatory  forces  of  the  United  States.  Even  if  our  forces 
would  be  paralyzed  only  temporarily,  an  SLBM  attack  allows 
enough  time  to  follow  up  with  an  all-out  ICBM  attack  from 
Soviet  missile  fields. 

Another  cause  for  concern  is  Soviet  rhetoric.  In 
the  spring  of  1983,  Anatoly  Alexandrov,  the  President  of  the 
Soviet  Academy  of  Sciences,  announced: 

"The  Soviet  Onion  will  adopt  a  policy  of  automatic 
massive  Retaliation  against  all  potential  enemies  if  the 
new  American  medium-range  nuclear  missiles  are  deployed 
in  Western  Europe."  [Hef.  4] 

Although  the  Soviets  frequently  hint  at  using  a  launch-on- 
warning  posture,  Alexandrov’s  remarks  are  more  definite  than 
previous  statements  of  the  Soviet  position.  Alexandrov 
claims  that  the  current  balance  of  strategic  forces  allows 
roughly  30  minutes  for  both  sides  to  take  steps  to  avoid  a 
nuclear  confrontation.  (This  refers  to  the  ICBM  forces,  but 
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should  be  denied  \.he  freedom  of  first  use  of  nuclear 
weapons.  At  the  same  time,  he  hinted  at  renewed  Soviet 
interest  in  a  launch-on-wacning  policy.  It  is  a  mistake  to 
discount  Soviet  statements  as  mere  political  bluff.  Soviet 
threats  contain  exaggeration,  but  they  also  have  a  rationale 
that  gives  us  insight  into  their  thinking.  Automatic  or 
quick-launch  systems  are  a  preeminent  design  goal  for  the 
Soviet  I CBN  forces.  These  capabilities  are  not  a  by-product 
of  Soviet  technology;  they  are  a  guiding  principle,  and  they 
continue  to  be  an  integral  feature  of  the  Strategic  Rocket 
Forces  (SRF) . 

The  emphasis  on  pre-emption  in  Soviet  peacetime 
doctrine  is,  of  course,  no  guarantee  that  pre-emption  would 
actually  be  used  in  a  crisis.  However,  just  the  knowledge 
of  a  pre-emptive  philosophy  adds  to  our  fear  of  surprise 
attack  from  Soviet  forces.  Also,  it  is  unimaginable  that 
the  Soviets  would  operate  their  nuclear  forces  in  a  launch- 
on-warning  mode  during  peacetime.  The  chief  consequence  of 
their  emphasis  on  pre-emption  may  be  that  it  serves  as  an 
indoctrinating  force  throughout  their  defense  organization. 
However,  once  a  country  incorporates  a  view  of  war  into  the 
planning  process,  competing  theories  of  conflict  will  prob¬ 
ably  receive  less  attention.  By  building  an  arsenal  and  a 
training  system  directed  toward  pre-emptive  attack,  the 
Soviets  preclude  alternative  strategies  from  consideration. 
Thus,  it  becomes  more  unlikely  that  plans  could  change  at 
the  last  moment  in  a  crisis.  Now,  in  the  1980s,  the  Soviets 
have  reached  a  virtual  nuclear  parity  with  the  Onited 
States.  With  an  increase  in  the  certainty  of  a  successful 
pre-emptive  attack  may  come  an  increase  in  the  probability 
of  nuclear  war  if  East- West  tensions  are  not  reduced 
[Ref.  2]. 
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II.  BACKGROUND 


A.  WHY  STUDY  THE  PROBABILITY  OF  ACCIDENTAL  NUCLEAR  SAB? 

1 .  The  Historical  Perspective 

From  our  everyday  newspapers,  we  read  about  the 
increasing  tension  and  anxiety  surrounding  the  strategic 
forces  of  the  United  States.  Since  the  close  of  World  War 
II,  the  Western  Alliance  has  feared  attacks  from  the  Soviet 
Union  in  Europe  and  in  other  United  States  defended  territo¬ 
ries,  as  well  as  the  subjugation  of  its  power  and  ideals  to 
the  Communist  philosophy.  Of  course,  the  Soviet  Union  fears 
the  same  from  the  West.  In  between  the  super  powers  lie  the 
smaller  nations,  each  wanting  to  expand  their  own  influence 
and  power  in  the  world  in  ways  similar  to  the  super  powers, 
especially  by  building  or  buying  nuclear  weapons.  Thus, 
early  warning  systems  have  grown  to  extreme  importance  over 
the  last  thirty  years. 

Looking  at  the  Soviet  warning  system  raises  some 
deeply  troubling  issues.  When  it  is  examined  as  a  system, 
and  not  merely  as  a  physical  collection  of  radars  and 
computers,  we  see  a  consistency  between  doctrine  and  capa¬ 
bility.  The  Soviet  doctrine  is  one  of  pre-emptive  attack, 
and  the  Soviet  capability  is  a  system  of  warning  and  command 
that  supports  such  a  strategy.  The  Soviet  experience  of 
invasion  may  help  to  explain  the  reason  for  this  approach. 

Ever  since  the  Nazi’s  attack  in  1941,  the  Kremlin 
proscribed  to  the  concepts  of  surprise  attack,  pre-emptive 
attack,  and  automatic  firing.  These  policies  fuel  our 
apprehensions  about  the  Soviets,  particularly  during  times 
of  crisis.  As  recently  as  July  1982,  Defense  Minister 
Dimitri  Ustinov  iterated  the  idea  that  the  United  States 
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b.  Strategic  Air  Command  (SAC) 

--located  (underground)  in  Omaha,  Nebraska 

--has  the  authority  and  responsibility  to  launch  the 
nuclear  bomber  force  to  protect  it 

—  maintains  a  small  percentage  of  the  bomber  force  on 
constant  alert 

— operates  and  constantly  maintains  an  airborne  command 
post 

c.  National  Military  Command  Center  (NMCC) 

— located  in  the  Pentagon 

— anticipates  and  evaluates  foreign  crises 

—  point  of  contact  for  the  President  to  obtain  information 
and  command  the  nuclear  forces 

d.  Alternate  National  Military  Command  Center 
(ANMCC) 

— located  (underground)  in  Fort  Richie,  Maryland 

--acts  as  the  alternate  location  for  NMCC  with  the  same 
functions  as  NMCC 

The  missile  warning  system  employs  a  two-step  process 
for  identifying  a  missile  launch  and  assessing  the  threat  to 
the  North  American  continent.  First,  the  infrared  warning 
satellites  detect  the  infrared  signature  of  a  burning 
missile  motor.  Ground-based  radars  provide  back-up  confir¬ 
mation  data  and  rely  on  detection  using  a  different  physical 
phenomenon;  i.  e.,  radar  tracking  of  a  physical  object  as 
opposed  to  detecting  the  infrared  signature.  This  two-step 
process  is  called  dual  phenomenology  and  minimizes  the  like¬ 
lihood  of  mistaking  some  natural  phenomenon  for  a  launch  of 
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an  enemy’s  missile.  For  the  purposes  of  this  thesis,  dual 
phenomenology  means  the  use  of  different  types  or  families 
of  sensors  to  detect  the  same  launch. 

The  BMEWS  radar  confirms  and  characterizes  a  polar  ICBM 
attack.  Pave  Paws  radar  detects  SLBM  launches  and  SEWS 
covers  both  ICBMs  and  SLBMs.  Thus,  after  the  detection  of 
an  infrared  signature,  the  BMEWS  radars  would  be  the  first 
to  detect  ICBMs;  the  Pave  Paws  radar  would  be  the  first  to 
detect  SLBMs  launched  off  either  coast.  The  two  radars  in 
Florida  perform  the  same  function  as  the  Pave  Paws  radar  for 
missiles  coming  from  the  Gulf  of  Mexico. 

The  satellites  and  Pave  Paws  radar,  the  two  sensors  that 
detect  the  attack  of  SLBMs,  feed  their  data  directly  to  all 
four  major  command  posts  (so  all  four  receive  and  evaluate 
the  data  simultaneously).  In  addition,  NORAD  transmits  its 
analysis  of  any  SLBM  attack  to  the  other  three  command 
posts.  Thus,  the  duty  officers  at  the  other  sites  have  two 
separate  computations  and  displays  of  the  SLBM  launches. 

Data  from  all  other  warning  sensors  feed  only  into  the  NORAD 
command  post,  where  it  is  analyzed.  The  other  three  command 
posts  then  receive  the  results  of  the  NORAD  analysis  by 
transmission  over  the  communication  lines. 

In  order  to  ensure  that  the  communication  lines  between 
NORAD  and  the  other  three  command  posts  remain  open,  NORAD 
constantly  transmits  messages  to  the  other  sites  over 
circuits  that  would  transmit  an  actual  attack.  Normally, 
this  message  contains  test  data  so  that  all  three  sites  can 
monitor  the  condition  of  their  communication  links  from 
NORAD.  If  the  system  works  properly,  all  command  posts 
receive  similar  information.  When  any  indication  of  a  real 
threat  exists,  including  ambiguous  data,  the  four  command 
posts  begin  a  conferencing  procedure  to  evaluate  and  assess 
the  data  available. 
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If  the  Soviets  launch  SLBMs  and  ICBMs  separately  or 
simultaneously ,  the  following  sequence  of  events  probably 
would  occur: 

1.  Satellites  detect  launches  of  SLBMs  or  ICBMs  shortly 
after  launch. 

2.  Pave  Paws  radar  picks  up  the  SLBMs  2-5  minutes  after 
launch. 

3.  BMEWS  radar  picks  up  the  ICBMs  within  10  minutes  of 
their  launch. 

4.  PARCS  radar  picks  up  the  ICBMs  in  the  terminal  phase 
of  flight . 

Approximately  9- 12  minutes  exist  between  launch  and  impact 
of  an  SLBM.  Time  between  launch  and  impact  of  an  ICBM  is 
approximately  25-30  minutes.  Since  an  SLBM  can  destroy  a 
large  portion  of  our  ground-based  sensors  and  command  posts, 
the  time  our  current  system  is  fully  operational  could  be 
severely  shortened.  This  does  not  mean  that  the  entire 
system  would  disappear  at  the  end  of  the  approximate  9  min¬ 
ute  period.  But  then  we  could  only  depend  on  those  assets 
that  survive  the  initial  attack;  that  is,  assets  that  are 
airborne  in  time  to  escape  the  attack.  Thus,  the  short 
interim  between  detection  of  an  attack  and  destruction  of 
the  major  portion  of  our  command  and  control  structure  puts 
a  severe  stress  on  the  decision  maker. 

B.  SEHSOR  PE0CESSI1G 

The  sensor  evaluation  process  entails  the  following 
steps: 

1.  An  event  triggers  a  sensor. 

2.  The  satellite  sensor  relays  a  signal  to  its  respective 
ground  station. 
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3.  The  sensor  ground  station  computer  interprets  the 
radar  signals. 

4.  The  computer  system  analyzes  the  signals. 

5.  The  computer  system  relays  its  analysis  to  the  system 
operator  . 

6.  The  computer  system  generates  a  message  to  the  command 
posts. 

7.  The  command  post  verifies  if  an  actual  message  was 
sent  . 

8.  The  sensors  continue  to  follow  the  path  of  the  object 
and  send  update  messages  . 

In  every  step  of  the  above  procedure,  the  man- in-the- 
loop  observes  and  evaluates  the  processed  data.  Therefore, 
the  processed  data  will  be  declared  a  false  alarm  if,  in  the 
experience  of  the  man-in-the-loop,  the  processed  warning 
data  indicates  a  false  display  of  a  launch  which  may  be 
caused  by  some  natural  phenomenon,  or  the  man-in-the-loop 
has  little  confidence  in  what  the  computer  system  tells  him 
about  the  supposed  threat.  Likewise,  if  a  computer  compo¬ 
nent  fails,  perhaps  generating  a  false  display,  but  the 
sensors  never  register  a  missile  launch,  then  the  man-in- 
the-loop  will  also  recognize  this  as  a  false  alarm. 

C.  COHHAHD  CEBTEB  PBOCESSING 

Both  NORAD  and  SAC  receive  missile  warning  data  from 
SEWS  and  Pave  Paws  radars.  NORAD  receives  data  from  BMEWS, 
Cobra  Dane,  and  PARCS  radars  and  sends  summary  messages  to 
SAC.  NMCC  and  ANMCC  receive  only  a  summary  of  the  missile 
warning  data  from  NORAD.  Since  NORAD  obtains  more  informa¬ 
tion  (ICBM  and  SLBN  data)  than  any  other  command  post  in  the 
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system,  the  Commander-in-chief  of  NORAD  (hereafter,  CINC 
NORAD)  assesses  the  sensor  warning  data. 

If  the  data  gathering  system  indicates  a  launch, 
specialized  centers  in  the  Cheyenne  Mountain  Complex  are 
activated.  The  Missile  Warning  Center  calls  the  individual 
sensor  sites  to  confirm  the  validity  of  the  indication  of 
launched  missiles.  The  Space  Center  states  whether  the 
indicator  is  or  is  not  one  of  the  over  4,000  objects  already 
in  space.  The  Solar  Center  reports  any  solar  activity.  The 
Intelligence  Center  discloses  any  information  which  would 
add  to  the  definition  of  the  indicator.  With  all  this 
information  combined,  CINC  NORAD  makes  a  total  assessment  of 
whether  the  indicator  is  a  real  launch  threat  to  North 
America. 

If  the  satellites  trigger  the  warning  process,  any  one 
of  the  four  command  posts  can  call  a  conference.  At  the 
conference,  CINC  NORAD  makes  decisions  regarding  the 
threat/no  threat  situation  evaluated  by  the  sensors  with 
inputs  from  the  other  command  posts.  We  discuss  this 
conferencing  procedure  in  detail  in  Chapter  IV. 

D.  NORAD'S  ORGANIZATION  AND  MISSION 

1.  The  Sarlv  History  of  NORAD 

To  better  understand  the  Data  Oathering  Model,  and 
later,  the  Decision  Model,  it  is  important  to  realize  where 
NORAD  fits  into  the  picture  and  how  NORAD’s  mission  affects 
the  question  of  accidental  nuclear  war. 

By  the  mid-fifties,  the  United  States  Air  Force  had 
the  technology  of  continuous  warning  information.  Only  by 
redesigning  their  formal  organizational  structure  to  fit 
this  new  information  technology  could  the  Air  Force  pros¬ 
ecute  a  war  successfully.  This  resulted  in  the  creation  of 
NORAD  in  1957.  As  the  central  processor  of  real-time 
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warning  information,  NORAD  became  a  joint  United  States- 
Canadian  command  because  of  the  location  of  radars  and 
fighter  bases  in  Canada.  Its  job  included  the  integration 
of  BMEWS,  Sound  Surveillance  System  (SOSUS) ,  Distant  Early 
Warning  (DEW)  Line,  and  other  information  sources  for  an 
overall  warning  estimate  that  would  be  relayed  to  other 
command  centers,  such  as  SAC  and  the  Pentagon. 

NORAD  is  the  central  command  post  for  continuously 
monitoring  warning  and  intelligence  information  from 
multiple  sources.  It  is,  then,  the  central  coordinating 
institution  responsible  for  determining  when  the  United 
States  is  under  attack. 

NOBAD  serves  a  critical  alerting  role  in  an  elabo¬ 
rate  system  of  institutional  checks  and  balances  to  prevent 
unauthorized  or  inadvertent  use  of  nuclear  weapons,  either 
of  which  could  lead  to  a  nuclear  war.  The  Commander-in- 
chief  of  SAC  (hereafter,  CINC  SAC)  does  have  the  authority 
to  order  the  launch  of  the  bomber  force  in  order  to  prevent 
its  destruction  on  the  ground  by  incoming  enemy  missiles. 
However,  this  authority  depends  crucially  on  the  threat  of 
incoming  enemy  attack,  a  condition  determined  by  CINC  NOPAD. 

2  •  Today1  s  NORj\D 

Today,  NORAD  is  a  bi-national  partnership  between 
the  United  States  and  Canada;  CINC  NORAD  is  also  the 
commander  of  the  United  States  component,  the  Aerospace 
Defense  Command  (ADCOW)  .  Canadian  forces  come  from  the 
Canadian  Forces  Air  Defense  Group,  headquartered  at  North 
Bay,  Ontario.  The  senior  representative  of  the  Canadian 
Forces  is  the  Vice  Commander-in-Chief  of  NORAD.  CINC  NORAD 
reports  to  the  Joint  Chiefs  of  Staff  (JCS)  as  representing 
the  Specified  Command,  ADCOH.  As  the  Commander  of  Aerospace 
Defense  Center,  he  reports  directly  to  the  Chief  of  Staff  of 
the  Air  Force. 
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The  NORAD  mission  includes: 


(1)  Tactical  warning  and  attack  assessment  of  bomber  or 
ballistic  missile  attack  on  North  America 

(2)  Space  surveillance,  tracking,  and  cataloging  of  all 
human-made  objects  in  space 

(3)  Satellite  protection  of  friendly  satellites,  pro¬ 
viding  collision-avoidance  and  other  flight 
condition  information 

(4)  Satellite  attack  warning  and  verification  for  all 
United  States  satellites 

(5)  Peacetime  surveillance,  detection,  and  identification 
of  aircraft 

(6)  Support  for  the  Space  Shuttle  missions 

(7)  Operational  control  of  United  States  and  Canadian  Air 
Defense  Forces 

Also,  NORAD  has  the  responsibility  to  JCS  to  provide  world¬ 
wide  detection  of  missile  launches  and  nuclear  events.  This 
includes  the  Pacific  area  and  Europe,  as  well  as  the  area 
adjacent  to  the  North  American  Continent. 

To  accomplish  its  mission,  NORAD  exercises  opera¬ 
tional  control  of  the  detection  and  communications  systems, 
and  it  operates  and  maintains  the  analytical  systems  in  the 
NORAD  Cheyenne  Hountain  Complex  (NCMC).  NCMC  provides  NCA 
and  CINC  SAC  with  real-time  missile  warning  messages  and 
NORAD  confidence  assessments. 

The  NORA D  command  post  is  in  the  underground 
Cheyenne  Hountain  Complex  in  Colorado.  A  worldwide  network 
of  sensors  gathers  and  processes  missile  warning  information 
and  distributes  warning  messages  to  other  United  States  and 
Canadian  command  posts. 
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NORAD  does  not  engage  in  any  active  defense  such  as 
ballistic  missile  defenses  designed  to  intercept  ICBMs  and 
SLBHs.  This  task  is  reserved  for  SAC.  Specif ically,  NORAD 
employs  passive  defenses  that  protect  targets  by  such  means 
as  warning,  mobility,  and  sheltering  forces. 

E.  DATA  GATHERING  HO DEL  FORMULATION 

In  order  to  formulate  the  Data  Gathering  Model,  we  must 
establish  several  basic  assumptions  about  the  data  gathering 
process.  Three  examples  then  illustrate  the  importance  of 
time:  we  will  model  an  ICBM  scenario,  an  SLBH  scenario,  and 

a  test  shot  scenario. 

First,  we  assume  the  timely  detection  of  incoming 
missiles.  Timely  detection  of  missiles  determines  how 
quickly  a  response  to  an  actual  or  imagined  threat  can  be 
made.  Success  in  preventing  an  accidental  nuclear  war,  or 
in  protecting  strategic  forces,  depends  on  the  fastest 
possible  identification:  the  sooner  an  incoming  object  is 
identified  as  a  threat  or  non-threat,  the  more  time  is 
available  for  decision  makers  to  consider  appropriate 
responses. 

Second,  we  assume  that  communications  remain  intact  over 
the  entire  system  until  the  missiles  impact.  This  assump¬ 
tion  requires  some  explanation.  As  discussed  in  Steinbruner 
[Ref.  9:  p.  40],  an  electromagnetic  pulse  (EMP)  from  an 
exoatmospheric  nuclear  explosion  would  cause  interruption  of 
non-hardened  and  long  range  {HF,  LF)  communications.  To 
overcome  the  effects  of  EMP,  redundant  messages  sent  over 
the  communication  lines  contain  less  information,  ensuring 
that  some  information  gets  through  the  system.  However,  it 
takes  at  least  7  minutes  after  an  SLBH  launch  before  the 
first  exoatmospheric  explosion  occurs.  Also,  we  will  not 
consider  sabotage  or  human  errors  which  could  also  disrupt 
comm  unications. 
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Third,  we  assume  that  the  computer  system,  which 
contains  a  large  number  of  components  (both  hardware  and 
software) ,  has  high  reliability.  Performance  of  the  missile 
warning  task  requires  the  use  of  computers  and  high-speed 
communication  systems  which  both  sometimes  produce  erroneous 
data.  However,  dependency  on  computers  does  not  imply 
control  by  them,  since  the  data  gathering  system  only 
reports  and  evaluates  missile  warning  data  while  a 
completely  different  computer  system  controls  the  procedure 
for  launching  missiles.  At  every  step  of  the  process, 
experienced  personnel  evaluate  and  judge  the  meaning  of  the 
incoming  data.  Only  these  trained  personnel  can  direct  any 
action  in  response  to  what  the  warning  system  reports. 
Thorough  investigations  of  previous  false  alarms  led  to  more 
stringent  policies  and  practices  throughout  the  missile 
warning  system,  severly  curtailing  the  possibility  of  an 
inadvertent  launch.  The  additional  vigilance  of  the  man-in- 
the-loop  makes  inadvertent  launches  even  less  likely. 

1 .  The  Generic  Model 

As  stated  before,  the  Data  Gathering  Model  consists 
of  a  continuous  time  line  broken  into  finitely  many  (some¬ 
times  overlapping)  segments,  each  of  finite  duration: 

ti„*  of  flight  tJ— a—  a—  U— ii 

launch  impact 

Figure  3. 1  The  Generic  Data  Gathering  Model 

where  to  =  time  of  launch 

tl  =  first  detection 


t2  =  system  evaluation  of  launch  (threat/no 
threat) 


t3  =  second  detection 

t4  =  assessment  of  launch  by  decision  makers 
(threat/no  threat) 

t5  =  last  possible  time  to  decide  on  the 
type  of  response  (launch/no  launch) 

t6  =  time  of  impact 

The  time  line,  over  which  observations  are  taking 
place,  starts  with  the  friendly  forces  detecting  the 
launching  of  missiles,  and  ends  with  the  impact  of  missiles. 
Each  t (i)  is  the  time  when  the  data  gathering  system  de¬ 
tects,  evaluates,  and  completes  its  analysis  ox  the  sensor 
data  and  passes  along  the  information  to  the  decision-making 
system  so  evaluation  of  the  threat  can  be  resolved  prior  to 
impact.  The  minimu m  time  to  resolution  (that  is,  the  min¬ 
imum  amount  of  time  in  which  to  make  a  decision  to  launch  or 
not  launch)  =  (t5-t3).  Note  that  tO,  t5,  and  t6  are  fixed 
points,  and  if  t4  is  greater  than  t5,  a  serious  problem 
arises.  In  the  following  examples,  the  time  sequence 
remains  the  same. 

2 .  Examples 

a.  ICBM  Scenario 

Starting  with  the  least  stressful  situation,  an 
ICS M  launch  scenario,  the  model  describes  the  following: 

tO  tl  t2  t3  t4  t5  1 6 

time  of  flight  I - 1 - 1 - 1 - 1 - 1 - [ 

6  i  3  5  7  27  30  minutes 

launch  impact 

Figure  3.2  An  ICBN  Scenario 
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As  in  the  general  case  above,  the  definitions  of  to  through 
t6  remain  the  same.  The  minimum  time  to  resolution  of  the 
threat  is  ( 1 5— 1 3 )  =  22  minutes. 

b.  SLBM  Scenario 


The  model  below  describes  an  SLBM  launch 


scenario: 


tO  tl  1 2  t3  1 4  t5  t6 

ti.e  of  flight  J  I, - J— 4 - V - i“"i  minutes 

launch  impact 

Pigure  3.3  An  SLBM  Scenario 


Again,  the  definitions  for  tO  through  t6  remain 
the  same.  Notice  that  the  time  of  flight  for  the  SLBM s 
extremely  shortens  the  amount  of  decision  and  response  time. 
Here,  the  minimum  time  to  resolution  is  (t5-t3)  =  4  minutes. 

c.  Test  Shot  Scenario 

The  model  below  describes  the  situation  where 
the  data  gathering  system  monitors  test  shots  of  missiles: 

tO  tl  t2  t3  1 4  t5  t6 
ti.o  of  flight  J— ^ - 4 - 4— T - V'ii  minutes 

launch  impact 

Figure  3. ft  A  Test  Shot  Scenario 

Osually,  in  a  test  shot,  the  Intelligence  Center 
informs  C1NC  NORAD  that  a  test  shot  has  been  scheduled. 
However,  whether  or  not  intelligence  is  available,  the  data 
gathering  system  treats  a  test  shot  as  a  regular  launch  and 
calculates  an  impact  point.  By  t3,  the  decision  makers 
realize  it  is  a  test  shot,  but  continue  the  assessment 
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process  for  intelligence  gathering.  In  this  example,  the 
minimum  time  to  resolution  is  (t5-t3)  =  4  minutes. 

F.  SFHSITIYITT  ANALYSIS 

The  critical  area  of  sensitivity  analysis  lies  in  the 
data  processing  times  in  the  above  three  examples.  The 
longer  it  takes  to  process  incoming  data,  the  lass  time 
remains  to  make  important  decisions  on  whether  we  should 
launch  our  missiles.  Thus,  shorter  processing  times  buy 
more  decision  time  (which  becomes  more  precious  as  the 
scenarios  get  more  complex)  . 

Some  uncertainty  exists  in  the  Data  Gathering  Model. 

For  instance,  sensors  and  computer  hardware  components  do 
fail,  computer  software  is  not  totally  error  free,  and 
computer  operators  do  make  errors.  All  of  these  failures 
have  occurred  at  least  once  at  NOEAD  [Bef.  5:  pp.  5-9]. 
However,  in  every  case,  NOHAD  did  discover  the  error  and 
improve  its  data  gathering  system. 

In  reality,  the  time  segments  of  the  above  Data 
Gathering  Model  are  not  as  neat  and  precise  as  described. 

As  stated  before,  these  segments  overlap  and,  sometimes,  one 
event  will  occur  before  another. 

Since  satellites  view  the  world  from  one  vantage  point 
and  ground  stations  view  it  from  another,  some  discrepancies 
arise  that  could  cause  problems.  For  instance,  if  SEWS 
picks  up  a  launch  in  one  place,  but  Pave  Paws  picks  it  up  in 
another,  the  system  may  display  two  launches  even  though 
only  one  has  actually  occurred.  Sometimes  4-5  missiles  look 
like  30,  especially  when  debris  is  present.  These  possibil¬ 
ities  make  it  harder  for  the  decision  maker  to  state  high  or 
low  confidence  in  the  assessment  to  the  President  and  have 
an  effect  on  the  President’s  own  response  decision. 
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In  the  scenarios  below,  we  explore  the  ramifications  of 
the  overlapping  time  segments. 

1.  The  ICBM  Threat 

The  interval  between  tO  and  tl  is  split  into  two 
pacts.  In  the  first  30  seconds,  a  quick  look  report  flags 
some  phenomenon  which  could  be  a  launch.  In  the  next  1.5 
minutes,  the  initial  report  follows  with  the  probable  point 
of  launch  (the  azimuth)  and  the  direction  of  launch.  This 
information  assists  the  decision  maker  in  determining 
whether  the  launch  is  real  or  the  system  has  failed.  Since 
processing  occurs  in  the  satellite  and  at  ground  stations, 
the  time  from  tO  to  tl  could  be  more  than  2  minutes,  when 
the  system  delays  to  discriminate  between  a  natural  phenom¬ 
enon  and  a  real  launch,  or  when  the  decision  maker  calls  a 
ground  station  to  confirm  the  display  on  the  command  post's 
computer  monitor.  In  any  case,  when  several  satellites  pick 
up  a  possible  launch,  the  data  gathering  system  automati¬ 
cally  attempts  to  merge  the  individual  reports  into  a  single 
message,  then  transmits  this  message  to  the  decision  maker. 

In  the  interval  between  tl  and  t2  (about  30  sec¬ 
onds)  ,  the  data  gathering  system  evaluates  the  possible 
launch,  and  by  t2,  labels  it  a  threat/no  threat.  The  next 
interval,  from  t2  to  t3,  which  allows  time  for  a  second 
detection,  can  become  quite  large.  Depending  on  what  sensor 
picks  up  the  launch,  and  the  launch  trajectory,  this 
interval  could  be  anywhere  between  3  and  7  minutes  in 
length.  The  interval  between  t3  and  t4  is  approximately  30 
seconds.  Figure  3.5  graphically  represents  these  overlap¬ 
ping  intervals. 

We  now  explain  the  reason  for  the  3-7  minute 
interval  from  t2  to  t3.  There  are  four  major  phases  in 
launching  an  ICBM:  boost,  post-boost,  mid-course,  and 
re-entry.  The  boost  phase  usually  lasts  several  hundred 
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minutes 


2  0.5  7  0.  5  17  3  minutes 

ti-e  °f  £li9M  ti - - - - 

launch  impact 

Figure  3.5  The  ICBM  Time  Line 

seconds,  during  which  the  missile  starts  at  rest  and  accel¬ 
erates  to  about  7  kilometers/second  by  the  time  it  reaches 
an  altitude  of  about  200  kilometers.  Typically,  an  ICBM  is 
a  three-stage  rocket,  each  stage  contributing  more  than  2 
kilometers/second  to  the  missile  velocity.  During  the  boost 
phase,  satellite  sensors  can  easily  detect  the  launch,  and 
the  missile  is  relatively  vulnerable. 

In  sophisticated  missile  systems,  a  post-boost  or 
deployment  phase  follows  the  boost.  This  phase  may  last 
another  several  hundred  seconds.  During  this  phase,  a  post¬ 
boost  vehicle  maneuvers  to  achieve  a  variety  of  very  precise 
trajectories,  and  then  deploys  individual  re-entry  vehicles 
on  each  trajectory.  The  post- boost  vehicle  carries  a  very 
accurate  inertial  guidance  system  to  determine  its  position 
and  velocity.  It  maneuvers  to  correct  any  trajectory  errors 
produced  during  the  boost  phase  and  places  the  individual 
re-entry  vehicles  on  slightly  different  trajectories  to 
attack  different  targets.  The  individual  re-entry  vehicles 
are  commonly  known  as  Multiple  Independently  Targetable 
Re-entry  Vehicles  (MIRVs) .  Since  the  post-boost  vehicle 
uses  a  much  lower  thrust  level  than  the  booster,  the  rocket 
exhaust  is  much  less  visible  to  sensors. 

After  the  re-entry  vehicles  are  deployed,  they 
follow  their  respective  trajectories  for  approximately  1000 
seconds,  climbing  to  1000  kilometers,  and  then  falling 
towards  the  earth,  eventually  re-entering  the  atmosphere. 
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situation  rema in s  the  saae.  The  same  scenarios  presented  in 
Chapter  III  are  now  re-visited  below: 

1 .  The  Generic  Model 

This  scenario  describes  a  generic  launch: 

time  of  flight  I - 1 - 1 - I - I - I - 1 - I - I - 1 

TO  T 1  T2  T  3  T  4  T5  T6  TV  T8  T9 

launch  impact 

Figure  4. 1  The  Generic  Decision  Model 


where 


TO  =  time  of  launch 
T 1  =  first  detection 

T2  =  system  evaluation  of  launch  (threat/no 
threat) 

T  3  =  missile  display  conference  called 
T4  =  second  detection 

T 5  =  threat  assessment  conference  called 

T 6  =  assessment  of  launch  by  decision  makers 
(threat/no  threat) 

T7  =  missile  attack  conference  called 

T8  =  last  possible  time  to  decide  on  the  type 
of  response  (launch/no  launch) 

T9  =  time  of  impact 


Thus,  the  minimum  time  to  resolution  is  (T8-T4)  . 

The  suggested  times  in  the  following  scenarios  indi¬ 
cate  reasonable  times  to  impact  for  the  purposes  of  discus¬ 
sion  [Ref.  9:  p.  39]. 
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invoke  confusion  in  humans  that  leads  to  a  longer  resolution 
time  of  the  alarm.  Since  the  problem  with  compound  errors, 
especially  human  ones,  also  increases  the  number  of  possible 
outcomes,  no  system  can  protect  against  all  combinations. 

The  likelihood  that  multiple  events  lead  to  trouble  in¬ 
creases  as  the  activity  around  a  possible  threat  increases. 
Thus,  the  complexity  of  the  warning  system  may  amplify 
mistakes  when  forces  are  placed  on  alert. 

C.  DECISION  SO DEL  FOBMULATION 

Let  us  assume  that  the  Soviets  have  the  ability  to 
launch  successfully  a  coordinated  attack.  Such  an  attack 
requires  proper  timing  in  order  to  minimize  interference 
between  exploding  warheads  in  the  same  general  area  [Ref.  9: 
p.  39]. 

Again,  we  use  a  simple  time  line  to  model  the  decision¬ 
making  process.  We  illustrate  the  decision  process  by 
including  three  examples:  (1)  an  ICBM  scenario,  (2)  an  SLBM 
scenario,  and  (3)  a  test  shot  scenario.  We  assume  that  the 
time  of  flight  of  a  missile  is  independent  of  decision¬ 
making  time.  Also,  we  assume  that  the  decision  process 
presented  in  Section  A  of  this  chapter  pertains  here. 

Again,  we  assume  the  timely  detection  of  launched 
missiles.  Timely  detection  and  analysis  by  the  sensors 
allows  more  time  for  the  evaluation  and  decision-making 
process  and  for  response  to  the  threat  as  discussed  in 
Chapter  III.  Also,  we  assume  uninterrupted  communications 
over  the  entire  system. 

The  Decision  Model  time  line  includes  the  incorporation 
of  the  different  conferences,  and  the  minimum  time  to  reso¬ 
lution  is  the  minimum  amount  of  time  in  which  the  decision 
makers  must  decide  to  launch  or  not  launch  a  counter-strike. 
Recall  that,  in  any  scenario,  the  way  NORAD  handles  a 


politicians  will  act  in  the  face  of  an  actual  attack.  Arms 
control  treaties  enhance  the  uncertainty  in  intelligence  and 
decision  making  when  a  possible  launch  arrives  in  the  data 
gathering  system,  since  a  treaty  is  designed  to  "keep  the 
peace."  Because  a  surprise  attack  on  our  forces  is  practi¬ 
cally  unimaginable  in  peacetime,  human  operators  may  hesi¬ 
tate  and  rely  on  the  peacetime  checks  and  balances  designed 
to  keep  our  forces  from  going  to  war  accidentally.  The  key 
problems  here  involve  our  belief  that  nuclear  attack  and  war 
are  unthinkable,  dampening  our  response  behavior  to  launch, 
which  requires  precise  timing.  Improving  the  warning 
sensors  and  the  communication  lines  may  ease  the  problem, 
but  such  improvements  can  not  completely  solve  it.  Because 
decades  have  passed  without  attack,  and  since  the  implica¬ 
tions  of  authorizing  a  nuclear  war  are  unthinkable,  the 
President,  as  well  as  other  senior  military  personnel  in 
charge  of  the  response,  may  be  unwilling  to  launch  any 
missiles  immediately  upon  receipt  of  the  news  of  an 
impending  attack.  This  hesitation  in  response  could  seal 
our  fate.  The  longer  the  assessment  and  conferencing  proce¬ 
dures  take,  the  more  opportunity  the  first  striker  has  to 
attack  again  and  further  disrupt  the  reactions  of  the 
victim.  The  victim  would  have  to  meet  the  attacker's  first 
strike  with  carefully  planned  strikes  against  the  attacking 
nation’s  sensor  and  warning  systems,  as  well  as  against 
military  forces,  in  order  to  disrupt  the  attacker's  ability 
to  engage  in  additional  strikes.  The  victim  must  launch  a 
retaliatory  attack  during,  or  soon  after,  the  first  strike. 

Dnavoidable  false  alarms  from  the  data  gathering  system, 
or  from  human  error,  contribute  to  the  slowing  of  the  deci¬ 
sion  process,  since  it  takes  longer  to  confirm  an  alarm  as 
false.  While  the  complexity  of  the  system  does  make  us 
safer  from  accidental  nuclear  war,  it  only  protects  us 
against  isolated  failures.  Multiple  errors  or  malfunctions 
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preventing  accidental  or  unauthorized  use  of  weapons. 
Preventing  errors  of  this  type  requires  maintaining  negative 
control.  Negative  control  means  that  a  variety  of  physical 
constraints  and  organizational  procedures  make  it  highly 
unlikely  for  any  one  individual  to  fire  any  nuclear  weapons. 
It  is  equally  improbable  that  the  necessary  combination  of 
people  required  to  fire  these  weapons,  in  the  absence  of 
proper  authority,  could  be  organized. 

If  war  actually  were  to  break  out,  the  dominant  objec¬ 
tive  changes  to  the  execution  of  retaliatory  attacks.  It 
then  becomes  important  to  minimize  failures  to  launch 
weapons  against  preassigned  targets.  Preventing  errors  of 
this  type  requires  positive  control :  the  smooth  operation 
and  precise  timing  required  to  launch  missiles.  Negative 
and  positive  control  inherently  conflict;  enhancing  one 
diminishes  the  other  to  an  extent  determined  by  the  details 
of  the  command  arrangements  for  particular  weapon  systems 
[Bef.  9:  p.  38]. 

The  issue  of  positive  and  negative  control  brings  up 
additional  uncertainty,  in  the  form  of  proper  timing  of  a 
launch.  The  decentralization  problem  made  by  the  great 
destructiveness  of  nuclear  weapons  emphasizes  the  conflict 
between  positive  and  negative  control.  A  single  location, 
or  even  a  few  locations,  can  not  control  a  modern  strategic 
arsenal  since  these  locations  may  be  identified  by  the  enemy 
and  pre-emptively  destroyed.  Thus,  many  military  officers 
at  numerous  locations  (some  mobile)  maintain  the  physical 
ability  to  fire  nuclear  weapons,  although  authorization  must 
be  given  and  elaborate  procedures  followed.  Since  the 
Soviets  have  reputed  to  do  the  same,  more  uncertainty 
involving  many  more  people  with  access  to  nuclear  weapons 
comes  into  play. 

The  response  of  the  attacked  nation  is  yet  another 
uncertainty.  It  is  impossible  to  predict  in  advance  how  the 
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personnel  confer  in  order  to  determine  the  nature  and  magni¬ 
tude  of  the  threat  to  North  America,  and  they  direct  prelim¬ 
inary  steps  to  be  taken  to  enhance  force  survivability  (such 
as  preparing  for  a  SAC  take-off.)  CINC  NORAD’s  assessment 
will  contain  either  high  or  low  confidence  in  what  the 
sensors  reveal.  At  this  time,  if  the  ground  stations  report 
a  confirmation  by  more  than  one  family  of  sensors,  then  CINC 
NORAD  reports  hiqh  confidence  in  the  confirmed  threat. 

3.  The  Missile  Attack  Conference 

If  CIRC  NORAD's  assessment  to  the  President  contains 
high  confidence,  CINC  NORAD  then  convenes  a  missile  attack 
conference  which  includes  all  senior  personnel  and  the 
President.  No  missile  attack  conference  has  ever  been 
called.  To  arrive  at  a  missile  attack  conference,  the 
conclusions  of  the  two  previous  conferences  revealed  that  an 
attack  on  North  America  is  imminent.  Since  it  takes  time  to 
convene  these  conferences,  time  is  at  a  premium. 

B.  ONCEBTAINTY  II  TBE  DECISION-MAKING  PROCESS 

Nuclear  deterrence  depends  on  maintaining  the  surviv¬ 
ability  of  strategic  forces.  Dncertainty  involving  the 
complete  success  of  a  missile  attack  on  either  the  attack¬ 
er's  or  defender's  side  acts  as  a  powerful  deterrent  since  a 
first  strike  represents  an  unprecedented  gamble.  Intel¬ 
ligence  information  is  rarely  complete  and  when  decision 
makers  confront  the  uncertainty  of  a  launch  during  a  confer¬ 
ence,  they  must  weigh  the  logical  consequences  of  such  an 
act  and  decida  on  a  response  to  it.  This  deliberation 
continues  to  erode  the  time  remaining  before  our  missiles 
must  be  launched  (or  lost)  . 

In  deploying  offensive  forces  for  the  purpose  of  deter¬ 
ring  war,  the  dominant  peacetime  objective  is  that  of 
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system  (such  as  position  or  configuration  changes  to 
sensors),  cause  unusual  information  or  conflicting  data  to 
appear. 

Since  we  must  maintain  a  highly  sensitive  system, 
many  indications  of  detections  arise  that  are  evaluated  as 
not  being  associated  with  a  real  missile  launch.  Bvery  year 
many  missile  display  conferences  are  called  to  deal  with 
events  other  than  potentially  threatening  or  ambiguous 
missile  launches. 

CINC  SO RAD  officially  terminates  a  missile  display 
conference  when  the  decision  makers  judge  the  available  data 
to  indicate  either  the  presence  or  absence  of  a  threat  to 
North  America.  If  the  perceived  threat  turns  out  to  be  some 
natural  phenomenon  such  as  a  solar  reflection,  CINC  NORAD 
terminates  the  missile  display  conference,  declaring  the 
situation  as  no  threat.  System  operators  at  NORAD  call  the 
ground  sites  to  confirm  what  appears  on  their  displays.  If 
nothing  appears  on  the  displays  at  the  ground  sites,  the 
system  operators  at  NORAD  will  then  trace  the  problem,  but 
CINC  NO RAD  will  not  call  a  threat  assessment  conference  (the 
next  conference  in  the  decision  process).  However,  if  the 
situation  at  NORAD  agrees  with  the  display  at  the  ground 
stations,  it  is  considered  a  threat.  CINC  NORAD  then  termi¬ 
nates  the  missile  display  conference  and  takes  the  next  step 
by  calling  a  threat  assessment  conference. 

2 •  The  Threat  Assessment  Conference 

As  stated  above,  if  CINC  NORAD  judges  a  launch  to  be 
a  threat  by  confirming  the  incoming  data  with  the  ground 
sites,  he  convenes  a  threat  assessment  conference.  This 
conference  requires  the  addition  of  more  senior  personnel  to 
assist  the  duty  officers  at  the  various  command  posts  in 
their  evaluation  of  the  confirmed  threat.  Senior  personnel 
include  the  Chairman  of  the  J'  int  Chiefs  of  Staff.  These 
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then."  On  the  other  hand,  the  other  two  legs  of  the  stra¬ 
tegic  triad,  submarines  and  the  bomber  force,  are  less  vuln¬ 
erable  when  deployed.  These  forces  also  remain  under  strict 
human  control  at  all  times.  Bombers  can  be  recalled  easily 
from  their  holding  stations,  but  the  submarine  forces  have 
more  flexible  instructions.  These  instructions  restrain 
submarine  commanders  from  launching  missiles  without  author¬ 
ization  or  allow  them  to  maintain  a  neutral  position. 

Generally,  the  more  missiles  launched,  the  easier  it  is 
to  decide  a  threat/no  threat  situation,  since  a  massive 
launch  strongly  indicates  a  real  attach.  The  problem  arises 
when  only  one  missile  appears,  if  the  sensors  detect  some 
natural  phenomenon,  if  spurious  warning  data  enters  the  data 
gathering  system,  or  if  a  component  in  the  system  fails.  If 
the  indication  of  a  launch  comes  from  the  ocean,  this 
heightens  the  problem  even  more,  since  less  time  is  avail¬ 
able  to  evaluate,  assess,  and  respond  to  the  threat.  If 
CINC  NORAD  assesses  a  single  missile  threat  with  high  confi¬ 
dence,  the  President’s  decision  problem  becomes  extremely 
difficult. 

Next,  we  discuss  three  major  components  of  the  Decision 
Model  conference  procedure:  (1)  the  missile  display  confer¬ 

ence,  (2)  the  threat  assessment  conference,  and  (3)  the 
missile  attack  conference. 

1 .  The  Miss ile  Display  Conference 

Upon  detecting  a  possible  launch,  the  missile 
warning  system  passes  its  analysis  of  threat/no  threat  to  a 
decision  maker,  and  a  formal  missile  display  conferencing 
procedure  convenes  to  evaluate  and  assess  the  analysis.  Any 
of  the  four  duty  officers  at  the  command  posts  may  call  this 
initial  conference,  if  the  data  gathering  system  at  the 
command  post  indicates  a  possible  threat.  CINC  NORAD  calls 
a  routine  missile  display  conference  whenever  changes  to  the 
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IT.  DECISIOS  MODEL 


1.  DESCRIPTION  OF  THE  COBHENT  DECISION  PROCESS 

The  missile  warning  function  involves  two  major  Air 
Force  commands — NORAD  and  SAC.  NORAD  has  the  responsibility 
for  the  management,  maintenance,  and  operation  of  all  the 
early  warning  sensors,  in  addition  to  the  overall  air  and 
space  defense  of  the  United  States.  CINC  NORAD  has  the 
responsibility  for  the  management  and  operation  of  the 
command  post  at  the  Cheyenne  Mountain  Complex,  plus  the 
responsibility  for  the  interpretation  of  missile  warning 
data  sent  from  SAC. 

SAC's  responsibilities  include  maintaining  the  airborne 
command  post,  which  conveys  the  launch  order  if  the  under¬ 
ground  command  post  is  wiped  out.  SAC  is  also  responsible 
for  operating  its  computer  system,  which  receives  missile 
warning  data  from  SENS  and  NORAD.  CINC  SAC  is  personally 
responsible  for  keeping  the  bomber  and  tanker  forces  in  a 
ready  status  in  case  they  must  be  launched  for  surviv¬ 
ability.  When  launched,  the  bomber  force  does  not  proceed 
with  an  attack,  but  follows  orders  to  go  to  holding  posi¬ 
tions  where  it  waits  for  orders  either  to  commence  an  attack 
or  return  to  base.  SAC  repeatedly  practices  this  launching 
procedure  (using  a  small  percentage  of  the  force)  to  keep 
the  bomber  forces  continually  ready. 

A  number  of  questions  concerning  IC3M  silo  vulnerability 
and  the  missile  accuracy  of  the  Soviet  SLBMs  and  ICBMs 
persist.  The  big  question  in  the  decision  model  is  "Will 
our  ICBMs  be  able  to  ride  out  an  attack?"  If  we  believe  in 
silo  vulnerability  and  decide  to  launch  a  percentage  of  the 
ICBMs  in  the  event  of  a  real  threat,  then  the  ICBMs  are 
committed  and  can  not  be  recalled.  In  this  situation,  the 
decision  maker  must  face  the  decision  to  "use  them  or  lose 
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Figure  3.10  A  Cruise  Missile  Trajectory 

The  table  below  summarizes  the  times  discussed  in 
the  above  analysis: 


TABLE  I 

Time  Remaining  in  the  Data  Gathering  Model 


Interval 

I  CBM 

SI3H 

First  Detection 

28 

10 

System  Evaluation 

27.5 

9.' 

Second  Detection 

minimum 

24.5 

2. 

maximum 

27.5 

6.! 

CINC  NORAD’ 

s  Assessment 

minimum 

24 

2 

maximum 

27 

6 

President’s 

Time 

minimum 

17 

0 

(3  minutes 

to  impact) 

maximum 

21 

3 

President’ s 

Time 

minimum 

14 

0 

(6  minutes 

to  impact) 

maximum 

18 

0 
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impact  of  the  missile.  The  maximum  time  is  (t3-t0)  =9.5 
minutes,  which  allows  no  decision-making  time  and  2.5 
minutes  to  impact.  This  analysis  explains  why  an  SLBM 
launch  is  so  stressful  for  the  decision  maker. 

The  decision  maker  will  probably  take  about  30 
seconds  to  make  an  assessment  and  state  either  high  or  low 
confidence.  In  the  minimum  case,  this  leaves  3  minutes  for 
the  President  to  take  action.  In  the  maximum  case,  the 
situation  has  advanced  beyond  the  cut-off  time  to  initiate  a 
launch  order. 

With  6  minutes  as  the  maximum  time  required  to 
perform  a  launch  sequence,  that  is,  (t6-t5)  =  6  minutes,  a 
decision  maker  would  have  sufficient  time  for  assessment 
since  the  minimum  resolution  time  (t3-t0)  =5.5  minutes,  but 
if  the  assessment  takes  the  usual  30  seconds,  no  time 
remains  for  the  President.  If  the  resolution  time  is 
anywhere  from  the  minimum  { 1 3—  1 0)  =  5.5  minutes  up  to  6 
minutes,  the  (Jnited  States  could  still  execute  an  actual 
launch  order  in  time.  This  situation  illustrates  that  the 
demand  for  reliability  in  dual  phenomenology  and  reporting 
high  confidence,  plus  the  demand  for  reliability  in  a  launch 
order,  puts  the  decision  maker  in  a  severe  time  crunch.  In 
the  case  where  t4  occurs  after  t5,  or  when  an  SLBM  is 
launched  from  500  miles  vice  1000  miles,  the  overall  system 
permits  no  decision-making  time  at  all. 

The  new  capabilities  of  the  cruise  missile  present  a 
worse  case  scenario  shown  in  Figure  3. 10.  Currently,  the 
United  States  has  no  policy  to  deal  with  cruise  missile 
launches.  With  such  a  short  warning  time,  a  bomber  attack 
may  be  the  only  response  possible.  Although  the  cruise 
missile  is  a  limiting  case  (so  we  will  not  discuss  it  at 
length  here),  it  is  an  important  subject  for  future  investi¬ 
gations. 
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Figure  3.8  Two  Possible  SLB3  Trajectories 


Figure  3.9  Two  Possible  SLBrt  Trajectories 


Becall  that  the  minimum  tine  to  reach  t3  is  5.5 
minutes.  In  the  SLB3  scenario,  this  time  leaves  3.5  minutes 
decision-making  time  before  the  last  moment  a  response  can 
initiate  a  retaliatory  launch,  and  6.5  minutes  before  the 


2.  The  SLB1  Threat 


The  time  intervals  up  to  and  including  t3  remain  the 
same  here  as  in  the  ICBM  scenario.  However,  the  situation 
drastically  changes  in  this  scenario  due  to  the  much  shorter 
time  of  flight  of  an  SLBM: 

3  3.  5  3  minutes 

2  0.5  7  0.5  0  2  minutes 

ti.e  of  flight  tj) - - -J- - - H - ^ - 

launch  impact 

Figure  3.7  The  SLBM  Time  Line 

Figure  3.8  below  depicts  the  usual  SLBM  trajectory 
(about  1000  miles  from  shore)  together  with  a  depressed  SLBM 
trajectory.  This  graph  reveals  that  to  obtain  dual  phenome¬ 
nology  (using  Pave  Paws  as  an  example) ,  the  time  between  t2 
and  t3  will  increase  with  a  depressed  SLBM  launch.  This 
result  severely  shortens  the  time  for  the  decision  maker  to 
assess  the  situation. 

The  graph  in  Figure  3.9  shows  the  usual  SLBM  trajec¬ 
tory  together  with  an  SLBM  launch  at  500  miles  from  the 
coast  (about  as  close  as  a  submarine  can  get  to  launch  an 
SLBM  if  it  is  to  hit  its  target).  When  launching  an  SLBM, 
the  trajectory  will  probably  be  lofted  to  attain  enough 
speed  and  height  to  successfully  re-enter  the  atmosphere  and 
hit  its  target.  Although  this  lofted  trajectory  is  less 
accurate  in  hitting  the  target,  the  interval  between  t2  and 
t3  increases  while  the  ove-all  time  of  flight  (to  to  1 6 ) 
decreases.  This  results  in  decreasing  the  decision  makers' 
time.  Therefore,  the  closer  the  launch  is  made  to  the 
coast,  the  less  time  remains  for  the  decision  maker. 
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A  given  booster  delivers  a  given  payload  to  its 
greatest  range  on  the  minimum  energy  trajectory  and,  hence, 
is  the  most  likely  trajectory.  This  means  that  the  minimum 
time  {shortest  interval)  to  reach  t3  for  a  lofted  or  minimum 
energy  trajectory  is  about  5.5  minutes.  In  the  ICBH  scen¬ 
ario,  21.5  minutes  remain  for  decision-making  time  before  a 
final  response  is  required,  and  24.5  minutes  remain  before 
impact  of  the  missile.  The  maximum  or  longest  interval  of 
time,  (t3-t0)  =  9.5  minutes.  Since  the  decision  maker  will 
probably  take  30  seconds  to  make  an  assessment  of  high  or 
low  confidence,  this  allows  the  President  about  21  minutes 
in  the  minimum  case,  and  17  minutes  in  the  maximum  case,  to 
make  his  response  (see  Table  I). 

The  minimum  interval  between  t5  and  t6  is  about  3 
minutes.  This  covers  the  reaction  time  required  to  launch 
our  missiles  in  a  retaliatory  strike.  Reaction  time 
includes  the  encryption  of  messages  to  launch,  the  decryp¬ 
tion  of  those  messages  upon  receipt,  double-checking  the 
messages  for  accuracy  (that  is,  are  they  real  orders?),  and 
the  required  number  of  personnel  on  the  scene  to  unlock  and 
operate  the  missile  system.  Since  we  have  never  had  to 
perform  this  function,  other  than  in  a  training  exercise, 
this  minimum  reaction  time  does  not  include  any  failures  of 
components  in  the  launch  system  preventing  the  launch,  fail¬ 
ures  of  any  personnel  to  perform  their  duties,  nor  any  other 
uncertainties  that  may  occur.  A  more  realistic  time  is 
closer  to  6  minutes.  This  amount  of  time  accounts  for  the 
completion  of  actions  from  the  above  3  minutes,  plus  any 
extra  time  for  shock,  confusion,  dismay,  denial,  and  undue 
pressure  that  would  arise  from  receiving  a  real  launch 
order.  However,  using  6  minutes  as  a  maximum  time  required 
to  perform  the  launch  sequence  still  leaves  the  President  18 
minutes  to  decide  a  response  to  the  threat  in  the  minimum 
case,  and  14  minutes  in  the  maximum  case. 


This  is  the  mid-course  phase.  The  final  phase  is  re-entry 
and  lasts  from  30  to  100  seconds,  depending  on  the  specific 
trajectory  and  drag  characteristics  of  the  re-entry  vehicle. 
Figure  3.6  depicts  three  types  of  trajectories  for  an  ICBM: 


Figure  3. 6  Three  Possible  ICBH  Tr 

Lofted  trajectories  (high  re-entry 
greater  re-entry  vehicle  deceleration,  thu 
increased  time  of  flight,  since  the  flight 
However,  this  results  in  a  much  higher  acc 
the  target. 

In  depressed  trajectories  (low  re¬ 
re-entry  vehicle  heats  up  more,  reducing  t 
missile.  Note  that  the  Pave  Paws  radar  (f 
not  pick  up  a  depressed  ICBM  trajectory  as 
picks  up  the  other  two  types  of  trajectori 
radar  and  infrared  sensors,  the  difficulty 
job  increases  with  increased  range  and  inc 
view . 
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2.  Examples 

a.  ICBM  Scenario 

This  scenario  describes  an  ICBM  launch: 

time  TO  T 1  T2  T3  T4  T5  T6  T7  T8  T9 

flight  d  ^  !  1  d  d  d  d  2^  3^)  minutes 

launch  impact 

Figure  4.2  An  ICBM  Scenario 

The  definitions  of  TO  through  T9  remain  the  same  and  the 
minimum  time  to  resolution  is  (T8-T4)*  =  22  minutes. 

b.  SLBM  Scenario 

This  scenario  describes  an  SLBM  launch: 

time  TO  .  T1  T2  T3  T4  T5  T6  T7  T8  T9 

flight  d  ^idddddddld  minutes 

launch  impact 

Figure  4.3  in  SLBM  Scenario 

The  definitions  of  TO  through  T9  remain  the  same.  Thus,  the 
minimum  time  to  resolution  is  (T8-T4)  =  4  minutes. 

c.  Test  Shot  Scenario 

This  scenario  demonstrates  how  a  test  shot 
affects  the  decision-making  process  as  shown  in  Figure  4. 4 
below.  In  this  example,  the  minimum  time  to  resolution  is 
(T8-T4)  =  4  minutes.  Even  if  intelligence  reports  a  test 
shot,  the  conferencing  procedure  continues  as  if  it  is  an 
unknown  threat.  At  T4,  the  data  gathering  system  evaluates 
no  threat  based  on  the  projected  point  of  impact  (usually 
the  ocean).  Then,  the  decision  makers  realize  it  is  a  test 
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TO  T 1  T2  T3  T  4  T5  T6  T7  T8  T9 

i — ^ — i — ^ — 4 — 4 — ^ — | — 4 — 5i 

launch  impact 

Figure  4.4  A  Test  Shot  Scenario 

shot,  and  CINC  NORAD  will  not  call  a  threat  assessment 
conference.  In  this  example,  T5,  T6 ,  T7 ,  and  T3  may  never 
occur;  however  the  launch  will  continue  to  be  monitored  to 
gather  as  much  intelligence  data  as  possible. 

In  the  case  of  a  launch  indicator  lacking  dual 
phenomenology,  at  T4 ,  the  decision  makers  assess  the  situ¬ 
ation  and  state  whether  they  have  high.  or  low  confidence  in 
what  the  data  gathering  system  tells  them.  As  before,  the 
process  continues  until  full  confirmation  is  made  or  the 
sensors  stop  picking  up  the  launch  indicator. 

In  the  Decision  Model,  human  intervention  plays 
a  key  role  which  can  not  be  over-emphasized.  Human  inter¬ 
vention  is  both  a  positive  and  a  negative  aspect;  positive 
because  more  minds  influence  the  decision-making  process  and 
because  a  launch  in  retaliation  is  not  automatic  but 
requires  human  intervention  to  activate  the  launch  mecha¬ 
nisms.  The  negative  aspects  include  the  increased  time  it 
takes  for  a  decision  to  be  made  by  a  team  of  decision 
makers.  Moreover,  these  decision  makers  are  only  human  and, 
therefore,  prone  to  error. 

D.  SENSITIVITY  ANALYSIS 

Since  the  Decision  Model  is  an  extension  of  the  Data 
Gathering  Model,  we  will  transfer  the  ideas  from  the  sensi¬ 
tivity  analysis  of  the  Data  Gathering  Model  to  the  sensi¬ 
tivity  analysis  of  the  Decision  Model.  In  Figure  4.5  below, 
the  corresponding  points  of  the  two  models  are  shown: 
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The  Data  Gathering  Model 


time  of  flight 


ti  t^l  ’  t^  '  tl  '  t^  tb 


launch 


impact 


The  Decision  Model 

time  of  flight  ^  ^  ^  ^  ^  ^ 

launch  impact 

Figure  4.5  Corresponding  Points  of  the  Two  Models 

From  our  analysis  of  the  Data  Gathering  Model,  we 
observed  that  the  time  segments  of  the  Decision  Model  are 
not  as  precise  as  shown  in  Section  C  of  this  chapter.  These 
segments  also  overlap  and  one  event  may  occur  before 
another.  We  discuss  this  overlap  problem  in  the  examples 
below. 

1.  The  ICBI  Threat 

The  events  TO,  T1,  and  T2  (which  correspond  to  tO, 
tl ,  and  t2  in  the  Data  Gathering  Model)  take  the  same  amount 
of  time  as  described  in  Section  F  of  Chapter  III.  However, 
the  missile  display  conference  T3  can  not  be  called  until  T2 
=  t2  occurs.  At  the  point  T3,  the  duty  officers  of  all  the 
command  posts  confer  to  decide  if  the  threat  is  real  or 
false.  If  no  conflicting  information  arises,  and  the  deci¬ 
sion  makers  readily  agree,  this  decision-making  process, 
which  includes  confirmation  from  the  ground  site,  will  take 
about  2  minutes.  Figure  4.6  displays  the  time  span  and  will 
be  explained  below.  Note  the  independent  overlap  of  T4  with 
T5,  T6,  and  T7: 
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launch  impact 

Figure  4.6  Decision  Model  Time  Line  for  an  ICBM  Scenario 

During  this  conferencing  procedure,  the  data  gath¬ 
ering  system  continues  to  monitor  the  launch  phenomenon.  As 
stated  previously  in  the  Data  Gathering  Model,  the  time  to 
obtain  a  second  detection  at  T4  (dual  phenomenology)  could 
take  anywhere  from  3  to  7  minutes,  depending  on  the 
missile's  trajectory.  (Here,  T4  corresponds  to  t3  in  the 
Data  Gathering  Model.)  This  means  that  the  minimum  time 
(shortest  interval)  to  T4  is  still  about  5.5  minutes  and  the 
maximum  time  (longest  interval)  is  about  9.5  minutes,  but 
the  missile  display  conference  T3  will  occur  prior  to  he 
second  detection  T4.  Even  if  dual  phenomenology  does  not 
occur  after  T3,  CINC  NORAD  will  call  a  threat  assessment 
conference  at  T5.  If  T4  =  5.5  minutes,  then  CINC  NORAD  will 
have  high  confidence  before  going  on  to  T5 ,  and  the  threat 
assessment  conference  will  probably  last  about  one  minute. 
However,  if  T4  =  9.5  minutes  (or  longer),  this  will  not  be 
the  case.  The  decision  makers  will  probably  want  more  time 
to  assess  the  situation,  hoping  to  obtain  dual  phenomenology 
before  going  on  to  the  missile  attack  conference  at  T7.  By 
T6,  however,  the  decision  makers  will  have  made  their 
assessment  (with  or  without  dual  phenomenology).  Then,  CINC 
NORAD  will  call  the  missile  attack  conference,  reporting 
either  high  or  low  confidence  in  the  assessment  to  the 
President. 

In  the  minimum  (shortest  interval)  case,  with 
T4  =  5.5  minutes,  if  the  missile  display  conference  and  the 
threat  assessment  conference  take  1  minute  each  (overlapping 


time 

of 

flight 
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with  T4)  ,  (T7-T6)  =  30  seconds,  and  if  the  missile  attack 
conference  takes  about  1  minute,  then  the  President  would 
have  (T8-T7)  =  20.5  minutes  to  decide  on  his  response  and 
23.5  minutes  to  impact  at  T9.  However,  if  any  of  the 
conferences  (T3 ,  T5,  T7)  take  longer  than  above,  the  time 
between  T7  and  T8  will  be  shortened,  leaving  less  time  for 
the  President  to  make  his  decision. 

In  the  maximum  case,  without  waiting  for  dual  pheno¬ 
menology,  the  President  would  still  have  20.5  minutes  to 
decide  on  his  response,  but  he  would  be  working  with  a  low 
confidence  assessment.  Any  President  is  likely  to  be  reluc- 
tajit  in  giving  an  order  to  retaliate  without  high  confi¬ 
dence.  Thus,  if  T4  =9.5  minutes  and  CINC  NORAD  waits  for 
dual  phenomenology  (although  T5,  T6,  and  T7  would  still 
occur  while  waiting) ,  then  the  President  would  have  (T8-T7) 

=  17.5  minutes.  If  the  interval  between  T8  and  T9  is  actu¬ 
ally  6  minutes  (as  proposed  in  Section  F  of  Chapter  III) , 
this  would  allow  the  President  17.5  minutes  in  the  minimum 
case  and  13.5  minutes  in  the  maximum  case.  The  question  of 
waiting  for  dual  phenomenology,  therefore,  becomes  an  impor¬ 
tant  one.  He  discuss  the  implications  of  various  launch 
policies  which  bear  on  this  issue  in  Chapter  7. 

2.  The  SL3M  Threat 

The  time  intervals  up  to  and  including  T6  remain  the 
same  here  as  in  the  ICBM  scenario.  But  the  situation 
becomes  more  stressful  with  the  shorter  time  of  flight  for 
an  SLBM  with  the  addition  of  conferences.  Again,  the  situ¬ 
ation  regarding  depressed,  lofted,  and  minimum  energy 
trajectories  of  SLBMs  applies  here.  The  requirement  for 
dual  phenomenology  increases  the  time  between  T2  and  T4 
(corresponding  to  t2  and  t3  in  the  Data  Gathering  Model) 
when  the  SLBM  is  in  a  depressed  trajectory.  The  same  result 
occurs  if  a  submarine  launches  its  SLBMs  close  to  the  coast 
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as  described  in  Chapter  III.  Figure  4.7  shows  the  time  span 
for  an  SLBM  threat: 

time  TO  T1  T2  T3  T4  T5  T6  T7  T8  T9 

flight  i  2!  5  .3  I  ^  ^  6 i 5  ^  minutes 

launch  impact 

Figure  4.7  Decision  Model  Time  Line  for  an  SLBM  Scenario 

The  minimum  time  to  T4  is  5.5  minutes.  This  time 
permits  only  3.5  minutes  total  decision-making  time  before  a 
response  is  required  from  the  President  and  only  6.5  minutes 
before  impact  of  the  missile.  If  the  maximum  time  is 
(T4-T0)  =9.5  minutes,  then  no  decision-making  time  exists, 
and  only  2.5  minutes  remain  to  impact.  As  we  mentioned 
earlier,  T4  overlaps  T5  (T3  has  already  occurred).  The 
events  T6,  T7,  and  T8  can  occur  prior  to  T4  if  the  President 
is  willing  to  make  a  decision  with  a  low  confidence  assess¬ 
ment.  However,  if  he  requires  dual  phenomenology,  T8  can 
not  occur  until  T4  occurs,  thus,  shortening  the  final 
decision-making  time.  Any  President  with  peaceful  inten¬ 
tions  will  wait  until  T4  occurs  before  giving  an  order  to 
retaliate.  In  the  minimum  case,  the  President  has  (T8-T7)  = 
2.5  minutes  to  make  his  response.  In  the  maximum  case,  the 
President  has  no  time  left. 

With  6  minutes  vice  3  minutes  as  the  minimum  time  to 
perform  a  launch  sequence,  that  is,  (T9-T8)  =  6  minutes,  the 
President  would  have  no  time  to  think  if  (T4-T0)  =9.5 

minutes  and  dual  phenomenology  is  required.  In  any  case, 
the  conferences  will  have  to  be  rushed  (perhaps  only  30 
seconds  apiece),  if  any  assessment  is  to  be  given  to  the 
President  in  time  to  launch  a  retaliatory  strike  (if  that  is 
the  President’s  chosen  response.)  Because  of  this  extremely 
shortened  time  interval,  the  President  may  be  forced  to  make 
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a  decision  with  a  low  confidence  assessment  from  CINC  NORAD, 
if  dual  phenomenology  does  not  occur  within  9  minutes  after 
a  launch  of  an  SLBM  attack. 
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V.  THE  PHOBA  BILITY  OF  ACCIDENTAL  NUCLEAR  HAS 


A.  INTRODUCTION 

In  this  chapter,  we  combine  the  Data  Gathering  Model  and 
the  Decision  Model  to  show  the  implications  of  policies  such 
as  launch-on- warning  and  launch- under- attack  for  the  early 
warning  system.  We  first  describe  the  segment  of  the  time 
line  that  affects  the  decision  to  use  one  of  these  policies. 
We  assume  the  United  States  is  operating  under  peacetime 
conditions  in  this  discussion.  Tha  time  lines  in  Figure  5.1 
represent  the  intervals  of  time  during  which  launch  policies 
affect  future  decisions: 

The  Data  Gathering  Model 

tine  flight  t  ' ";J— 1  “J—  ''"4 

launch 

The  Decision  Model 

time  of  flight  I - I - i - 1 - j - 1 - 1 - 1 - 1 

TO  T 1  T2  T3  T4  T5  T6  T7  T8 

launch 

Figure  5.1  Affective  Segment  of  the  Time  Line 

The  affective  time  lines  do  not  include  impact  since  after 
T8  (t5) ,  no  time  remains  to  launch  effectively  a  retaliatory 
strike.  Also,  recall  that  a  false  alarm  occurs  if  (1)  a 
launch  detection  occurs;  (2)  the  data  gathering  system 
labels  it  a  threat  by  T2  when  no  threat  exists;  and  (3)  a 
threat  assessment  conference  is  called  at  T5  before  confir¬ 
mation  of  the  threat. 
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The  following  data  comes  from  NORAD  [Ref.  10]  and  shows 
the  number  of  conferences  called  from  1977-1983,  including 
the  false  alarms  discussed  earlier  in  Chapter  II: 


TABLE  II 

Emergency  Action  Conferences  by  Tear 


YEAR 

SOOTINE  MISSILE 

- nrs'pri? - 

COgrfEtSCES 

CONFERENCES  CALLED 

- T0~EVir&ATE - 

POSEISEITTTJEEATS 

THREAT 
ASSESSMENT 
COFFEKETTCE  S 

1977 

1567 

43 

0 

1978 

1009 

70 

2 

1979 

1544 

78 

2 

1980 

3815 

149 

2 

1981 

285  1 

186 

0 

1982 

3716 

218 

0 

1983 

3294 

255 

0 

The  routine  missile  display  conferences  do  not  fit  any 
of  the  previous  definitions  we  used  and,  therefore,  will  not 
be  considered  in  this  analysis.  Note  the  number  of  confer¬ 
ences  called  to  evaluate  possible  threats  (these  are  the 
missile  display  conferences,  as  we  defined  them  earlier). 

The  numbers  appear  to  increase  as  the  years  progress. 
However,  we  explained  the  cause  of  this  behavior  in  Chapter 
II.  The  false  alarms  that  occurred  in  1978,  1979,  and  1980 
resulted  in  the  threat  assessment  conferences  that  were 
called.  However,  in  those  cases,  confirmation  of  the  threat 
was  not  made:  in  each  case,  the  response  from  the  site 
indicated  that  a  threat  did  not  exist.  In  fact,  the  site 
had  absolutely  no  indication  of  a  launch  on  their  display. 


The  procedures  followed  in  those  years  differ  from  the  way 
CINC  NORAD  currently  calls  threat  assessment  conferences. 
Today,  if  no  confirmation  comes  from  the  site,  CINC  NORAD 
probably  will  stop  the  conferencing  process  at  that  point  to 
determine  if  there  is  a  failure  at  NCHC.  Thus,  a  threat 
assessment  conference  may  not  be  called.  If  the  site 
reports  launch  and  impact  points  in  close  agreement  with 
NORAD’s  incoming  data,  this  confirmation  gives  at  least  a 
low  confidence  assessment,  and  CINC  NDRAD  will  continue  the 
conferencing  procedure  by  calling  a  threat  assessment 
conference.  Nevertheless,  in  the  analysis  of  the  next  two 
sections,  we  use  the  above  table  as  if  the  threat  assessment 
conferencing  situations  are  the  same  (as  described  in 
Chapter  IV)  . 

B.  POLICY  TYPES  AND  DISCUSSION 

Fe  begin  this  discussion  with  the  la unch-on- warning 
case,  because  of  its  simplicity.  The  United  States  does  not 
currently  have  such  a  policy;  however,  there  are  many  advo¬ 
cates  of  launch- on-warning,  since  this  policy  improves  reac¬ 
tion  time  in  performing  a  counter-strike  launch. 

1 .  Launch -On- Warning 

Launch -on- warning  means  that  upon  detecting  the 
launch  of  an  enemy’s  missiles  and  confirming  the  threat  at 
the  site  (albeit  with  low  confidence) ,  we  would  launch  some 
fraction  of  the  threatened  ICBM  force  before  those  missiles 
reached  any  of  their  targets. 

This  extremely  broad  definition  contains  several 
important  implications.  For  instance,  to  carry  out  a 
launch-on-warning  policy  in  the  event  of  an  actual  enemy 
missile  launch,  the  decision  makers  must  declare  the  threat 
confirmed;  that  is,  the  data  gathering  system  and  the 
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decision  makers  both  must  agree  that  the  situation  is  a 
confirmed  threat  situation.  Then,  CINC  NOBAD  reports  low 
confidence  in  the  assessment  to  the  President.  A  launch-on- 
warning  stance  presumably  allows  more  time  for  the  bomber 
forces  to  escape  and  increases  the  amount  of  time  to  execute 
a  counter-strike.  The  SLBf!  scenario,  described  in  Chapter 
IV,  makes  the  importance  of  these  two  features  extremely 
apparent. 

Using  the  table  from  Section  A,  we  can  now  ask  the 
question,  "How  often  does  a  false  alarm  occur  in  the  case  of 
a  single  system  failure?"  Recall  that  threat  assessment 
conferences  were  called  in  the  situations  where  a. false 
launch  indication  occurred;  6  times  over  6  years.  Thus,  the 
average  arrival  rate  is  one  per  year  (for  a  single  detection 
with  lew  confidence). 

Adopting  a  launch-on-warning  policy  in  peacetime 
implies  that  if  a  single  failure  occurs  in  the  system,  and 
the  site  confirms  the  threat,  then  the  following  sequence  of 
events  may  take  place: 

time  of  flight  I -I - -1 - 1"— *1  "I 

TO  Tl  T2  T3  To  T6  T7 

launch  shoot! 

Figure  5.2  Launch-On-Warning  Time  Line 

Note  the  change  to  the  Decision  Model — the  decision  maker 
does  not  wait  for  T4  (second  detection  from  a  different 
family  of  sensors)  to  occur  before  giving  an  assessment  to 
the  President.  The  President  also  does  not  necessarily  wait 
for  a  second  detection  to  give  a  launch  order. 

Thus,  a  lower  bound  for  the  expected  waiting  time 
until  an  accidental  nuclear  war  is  1  year,  if  the  President 
chooses  to  retaliate  under  the  conditions  just  described. 
What  makes  this  a  lower  bound  is  the  fact  that  a  false  alarm 


must  persist  long  enough  without  dual  phenomenology  to 
convince  the  President  to  act  with  only  a  low  confidence 
assessment. 

In  any  case,  launch- on-warning  is  a  high  risk 
policy,  especially  when  great  international  tensions  exist 
between  the  United  States  and  the  USSR,  as  they  do  today. 

In  peacetime,  a  single  failure  without  dual  phenomenology 
puts  the  President  in  the  extremely  difficult  position  of 
deciding  how  long  to  wait  before  giving  an  order  to  launch  a 
coun  ter-strike. 

2 .  Launch -Under -At tack 

The  presence  of  dual  phenomenology  (the  conf irmation 
of  a  launch  by  two  families  of  sensors)  gives  much  more 
reliability  to  a  confirmed  threat.  In  previous  chapters,  we 
demonstrated  how  much  the  decision  makers  rely  on  dual 
phenomenology  to  reduce  the  chance  of  an  incorrect  response. 
We  now  discuss  how  much  better  the  warning  system  actually 
becomes. 

Currently,  the  United  States  has  a  launch-under¬ 
attack  policy.  In  this  thesis,  launch -under-attack  means 
launching  some  fraction  of  the  threatened  ICBM  force  when 
the  early  warning  system  confirms  a  threat  and  that  threat 
is  assessed  with  high  confidence.  Again,  the  data  gathering 
system  and  the  decision  makers  must  agree  in  their  assess¬ 
ment  that  the  threat  is  confirmed,  as  in  launch-on-warning. 
The  conditions  of  dual  phenomenology  and  a  predicted  impact 
point  in  friendly  territory  define  the  confirmed  threat. 

The  difference  in  this  policy  arises  from  CINC  NORAD's 
assessment  to  the  President:  here,  CINC  NORAD  reports  high 
confidence  in  what  the  sensors  reveal,  since  dual  phenome¬ 
nology  is  reguired.  The  President  is  still  the  responsible 
authority  for  the  initiation  of  the  launch:  whether  it  is 
one  missile  or  many  missiles,  the  decision  to  implement  a 
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launch-under-attack  rests  with  the  President.  fcn  advantage 
to  this  policy  is  that  a  launch-under-attack  lessens  the 
probability  of  accidental  nuclear  war  while  maintaining  a 
strong  deterrence. 

If  the  (Jnited  States  continues  to  follow  a  launch- 
under-attack  policy,  what  sequence  of  events  must  occur  to 
cause  an  accidental  nuclear  war?  Since  under  launch-under¬ 
attack,  the  Dnited  States  would  not  launch  a  retaliatory 
strike  if  only  one  system  failed,  a  necessary  condition  for 
accidental  nuclear  war,  in  this  case,  is  for  two  different 
faLse  alarms  on  two  different  sensors  to  occur.  Plus,  the 
false  alarm  on  one  system  must  overlap  the  false  alarm  on 
the  other  system.  Moreover,  the  two  systems  must  agree 
approximately  on  the  launch  and  impact  points,  so  that  the 
decision  maker  sees  the  same  launch  phenomenon  on  two  sepa¬ 
rate  systems.  The  overlap  time  must  also  be  of  sufficient 
duration  to  allow  enough  time  to  launch  a  counter-strike. 

In  Chapter  IV,  we  assumed  three  minutes  (initially)  to  carry 
out  the  launch  order. 
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Figure  5.3  The  Interval  Overlap 

The  minimum  overlap  time,  then,  is  defined  as  t 
tion  of  two  false  alarm  intervals  for  at  least 
In  Figure  5.3  above,  we  assume  that  the  time  in 
stochastically  independent,  and  so  are  the  fals 
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the  two  systems.  If  we  assume  that  the  arrival  process  of 
the  false  alarms  is  a  Poisson  process,  the  intervals  between 
arrivals  are  exponentially  distributed. 

In  order  to  calculate  an  upper  bound  for  the  prob¬ 
ability  of  a  double  false  alarm  using  dual  phenomenology  (a 
double  false  alarm  on  two  different  systems),  we  assume  the 
following: 

1.  We  disregard  the  difference  between  the  false  alarms 
on  the  two  different  systems  (assumed  above). 

2.  The  combined  rate  of  the  radar  false  alarms  and 
infrared  false  alarms  is  one  false  alarm  per  year. 

3.  The  time  between  arrivals  of  the  combined  false  alarms 
is  exponentially  distributed. 

If  all  these  false  alarms  involve  ICBM  launches 
,  only,  what  is  the  probability  that  two  successive  false 

alarms  occur  within  27  minutes  of  each  other  (i.  e.,  a  3 
minute  overlap) ?  Let 

X  =  the  time  between  false  alarms 

then 

P(X  <  k  minutes)  =  l-e"'" 

=  1  *  {1  ♦  ( — Xk )  ♦  (-Xk)  2/2!  ♦  .  .  .} 

where  X  is  one  per  year  (that  is,  the  mean  time  to  wait  for 
a  false  alarm  is  6/6,  or  one  year).  Dropping  all  but  the 
first  three  terms  gives 

P  (X  <  k  minutes)  Xk 
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in  minutes.  Note  that  the  units  for  X  and  k  must  conform. 
Since  we  assumed  that  it  takes  at  least  3  minutes  to  execute 
a  counter-strike  launch,  at  least  a  3  minute  overlap  is 
necessary.  This  is  the  "worst  case"  situation. 

The  upper  bound  (worst  case)  for  an  ICBN  scenario  is 
in  the  situation  where  a  3  minute  overlap  occurs.  Here,  the 
calculation  gives 

P  (X  <  27  minutes)  =  27/ (365 )  (24)  (60) 

=  0.000051 

Therefore,  a  lo^er  bound  for  the  expected  waiting  time  of 
this  event  is  1/0.000051  which  is  approximately  19,467 
years.  These  calculations  are  very  restrictive  since  we 
have  assumed  a  combined  false  alarm  rate.  This  assumption 
means  that  two  sensors  could  fail  in  the  same  family.  From 
what  we  have  described,  we  must  have  false  alarms  from  two 
families  of  sensors.  This  makes  the  probability  even  lower 
than  0. 000051  and  the  expected  waiting  time  greater  than 
19,467  years. 

The  upper  bound  for  an  SLBM  scenario  is  for  a  3 
minute  overlap  to  occur: 

P(second  false  alarm  occurs  <  9  minutes)  =  9/(365)  (24)  (60) 

=  0.000017 

In  this  case,  the  expected  waiting  time  to  a  double  false 
alarm  is  approximately  58,400  years.  The  upper  and  lower 
bounds  of  the  ITBM  scenario  cover  this  and  all  other 
situations. 

In  conclusion,  the  United  States  will  probably  never 
accidentally  launch  a  retaliatory  strike  with  a  launch- 
under-attack  policy,  if  the  false  alarm  rate  remains  the 
same  as  in  Table  II.  The  graph  in  Figure  5.4  shows  how  the 
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expected  waiting  tine  varies  with  different  lambdas. 
However,  Adding  sabotage  and  nuclear  proliferation  raises 
the  probability  and  decreases  the  expected  waiting  time. 
Nevertheless,  with  these  probabilities  as  upper  bounds,  a 
decision  maker  will  pause  and  take  time  to  analyze  false 
alarms  under  these  conditions. 
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Figure  5.4  Expected  Waiting  Time  7ersus  Lambda 


These  same  calculations  assist  the  decision  maker  in 
determining  whether  an  alarm  is  real  or  false  by  adding  the 
conferencing  procedure.  If  the  decision  maker  decides  the 
first  alarm  is  false,  then  when  a  second  alarm  occurs,  it 
merely  supports  the  fact  that  a  system  failure  has  occurred. 
Also,  including  the  conferencing  procedure  may  add  more  time 
to  the  process,  allowing  for  the  possibility  of  the  alarm 
being  confirmed  by  dual  phenomenology,  or  evaluated  as  no 
thr  eat. 
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This  addition  of  time  to  the  decision-making  process 
could  be  a  blessing  in  disguise.  If  the  system  gives  a  10 
minute  impact  time,  but  the  decision-making  process  already 
has  taken  15  minutes,  then  probably  no  launch  has  occurred. 
Thus,  if  no  impact  materializes  by  the  10  minute  limit,  and 
the  decision  makers  still  have  not  reached  a  decision,  the 
conferencing  procedure,  again,  will  probably  stop. 

C.  SUHHAEY 

Sophisticated  systems  to  warn  of  nuclear  attack  are 
necessary  for  the  protection  of  the  United  States.  Also,  if 
the  Soviets  know  that  the  (Jnited  States  has  an  effective 
warning  system,  they  are  less  likely  to  initiate  an  attack. 
Since  both  the  United  States  and  the  USSR  possess  effective 
warning  systems,  both  sides  have  less  incentive  to  launch  an 
attack,  and  the  world  is  more  stable  as  a  result. 

The  Missile  Attack  Warning  System  is  designed  to  make 
sure  that  the  decision  to  go  to  war  is  not  driven  by  a  flock 
of  geese  or  a  defective  computer  chip.  A  human  is  always  in 
the  decision  loop. 

Although  the  launch-on- war ning  policy  would  improve 
reaction  time  in  performing  a  counter-strike  launch,  it 
seriously  impairs  rational  decision  making  in  a  time  of 
extreme  stress.  A  launch-on-warning  policy  puts  the 
President  in  the  "hot"  seat  nearly  once  per  year.  But  such 
a  burden,  even  once  every  4- year  term,  would  be  enough  for 
any  President.  The  risk  of  accidental  nuclear  war  under 
launch-on-warning  is  great  enough  to  make  this  policy  very 
unattractive. 

launch-under-attack,  on  the  other  hand,  is  much  safer, 
given  its  requirement  for  dual  phenomenology.  The  condi¬ 
tions  necessary  for  a  double  false  alarm  (a  false  alarm  in 
two  separate  systems)  to  occur  in  a  time  overlap  of  at  least 
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3  minutes  make  the  probability  of  accidental  nuclear  war 
extremely  small.  The  President  must  still  undergo  immense 
pressure,  but  he  can  be  virtually  assured  of  making  the 
correct  response  decision. 
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ADCOM 

ANMCC 

BMEWS 

CISC  NO  RAD 

CISC  SAC 

DEM 

EMP 

TCBM 

JCS 

MIRV 

NCA 

NCMC 

NMCC 

NORAD 

PARCS 

SAC 

SEWS 


APPENDIX  A 

ACHONYMS  AND  ABBREVIATIONS 
Aerospace  Defense  Command 

Alternate  National  Military  Command  Center 

Ballistic  Missile  Early  Warning  System 

Commander- in-Chief ,  North  American 
Aerospace  Defense  Command 

Commander-in-Chief,  Strategic  Air  Command 
Distant  Early  Warning  Line 
Electromagnetic  Pulse 
Intercontinental  Ballistic  Missile 
Joint  Chiefs  of  Staff 

Multiple  Independently  Targeted  Re-entry 
Vehicle 

National  Command  Authority 

North  American  Aerospace  Defense  Command 
Cheyenne  Mountain  Complex 

National  Military  Command  Center 

North  American  Aerospace  Defense  Command 

Perimeter  Acquisition  Radar  Attack 
Characterization  System 

Strategic  Air  Command 

Satellite  Early  Warning  System 
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SLBM 

sosas 

SPi SUB 
SRF 


Submarine-Launched  Ballistic  Missile 
Sound  Surveillance  System 

United  States  Navy  Space  Surveillance  Network 
(Soviet)  Strategic  Rocket  Forces 
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